Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects anomalous activity from IDEs or AI coding assistant extension host processes (e.g., VS Code, Cursor, JetBrains). The rule alerts when these processes spawn children that access sensitive local credential files, perform network connections to non-standard/unexpected domains, or modify critical CI/CD build script configuration files, which is indicative of a supply chain compromise within the developer environment.
Detects potential runtime polymorphic malware that modifies its own executable or script content while simultaneously communicating with generative AI or LLM API endpoints. This behavior indicates an adversary using LLMs to regenerate obfuscated code or mutate malware signatures dynamically at runtime.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
TokenGrabber Builder: Webhook XOR/Base64 Obfuscation Artifacts - detects webhook.txt persistence, XOR 0x5A + Base64 webhook obfuscation, WEBHOOK_PLACEHOLDER injection, and the _x() decode routine used to recover the exfiltration endpoint
Detects unauthorized processes (excluding firefox.exe and explorer.exe) accessing or modifying sensitive Firefox browser profile files, specifically places.sqlite (history/bookmarks) and cookies.sqlite (session cookies). This activity is often indicative of credential or session hijacking attempts by malware or malicious scripts.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Page 16 of 109