Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule

Detects phishing campaigns targeting enterprise domains, as identified through CYFIRMA's Data Breach and Dark Web Monitoring. These alerts may include malicious URLs used for credential harvesting, domain impersonation, or social engineering. Immediate triage and takedown actions are recommended.

ATT&CK coverage

Outside the enterprise matrix

T1566.001Spearphishing Attachment 98 detections cover this technique
T1566.002Spearphishing Link 76 detections cover this technique
T1566.003Spearphishing via Service 6 detections cover this technique

Detection requirements

Log source product: cyfirmadigitalriskalertsconnector
Log source service: cyfirmadbwmphishingalerts_cl

What the source says

Tagged by the source as

ExfiltrationInitialAccess

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.