Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the deletion of suspicious files associated with macOS malware families commonly referred to as FLATROOF or ROOFDECK. The rule monitors for the removal of files located in specific directories ('com.apple.iTunesCloud/SystemUpdate' or 'com.apple.internal.ck/iSync') using system utilities like 'rm' or via the 'loginwindow' process, which is indicative of malware attempting to clean its tracks after execution or persistence.
Detects the loading of amsi.dll by common .NET loader processes, which may indicate attempts to patch or bypass the Antimalware Scan Interface (AMSI) in memory. The rule monitors for image load events of amsi.dll and correlates them with process creation events of known loaders such as powershell.exe, rundll32.exe, and others.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects web server processes (e.g., Apache, Nginx, PHP-FPM, IIS) launching suspicious shell or system administration utilities. This behavior is indicative of a web server compromise, potentially involving the use of web shells or the exploitation of public-facing web applications to execute arbitrary commands.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects creation of a token.cmd file in AppData followed by its execution via cmd.exe within a 5-minute window.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects a Node.js process spawning a detached, hidden child node.exe process from within a node_modules directory, a technique observed in the indexed-btree npm supply-chain malware to establish a stealthy runtime loader.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule detects a correlation between the creation or modification of a specific file name ('nloemfbihmhm') and the subsequent execution of processes from the 'Temp' directory involving related filenames ('kojuyn.ini', 'ogftogcyiblzjccmcbnw.exe', or 'nloemfbihmhm') within a 5-minute window. This behavior is indicative of a multi-stage execution chain, often used by malware to drop and execute secondary payloads.
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
Detects the execution of the AnyDesk installer when triggered by a process spawned from common web browsers. This pattern is often observed when users download and execute remote access software from the internet.
Detects the execution of a specific batch file named 'KB85809588.bat', either directly or via the Windows Command Shell (cmd.exe) and Console Host (conhost.exe). This pattern is often indicative of malicious scripts or automated tasks executed as part of an attack chain.
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
This rule monitors process creation events for common command-line obfuscation patterns used to evade detection. It flags suspicious usage of encoding (e.g., base64), character manipulation (e.g., caret char insertion, case randomization), and scripting-related concatenation or dynamic reassembly techniques within cmd, powershell, or script host commands.
Page 160 of 977