Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects activities associated with the MacSync backdoor, specifically focusing on persistence mechanisms such as LaunchAgent manipulation, .repair-run scripts, and suspicious GIT hook usage. It also correlates these events with the termination of macOS notification agents (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent), which is a tactic used to suppress security alerts during malicious operations.
This rule detects activities associated with the MacSync backdoor, specifically focusing on persistence mechanisms such as LaunchAgent manipulation, .repair-run scripts, and suspicious GIT hook usage. It also correlates these events with the termination of macOS notification agents (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent), which is a tactic used to suppress security alerts during malicious operations.
This rule detects activities associated with the MacSync backdoor, specifically focusing on persistence mechanisms such as LaunchAgent manipulation, .repair-run scripts, and suspicious GIT hook usage. It also correlates these events with the termination of macOS notification agents (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent), which is a tactic used to suppress security alerts during malicious operations.
This rule detects the GHAPPIER multi-stage loader, typically observed in 'indexe.cjs' files. The loader fetches and executes a remote payload from a Vercel-hosted domain (primevector-app924560.vercel.app) using 'eval' on retrieved content, or matches specific payload identification tags.
Detects instances where npm processes (install, preinstall, or postinstall) spawn suspicious child processes such as shell interpreters (cmd, powershell, bash, sh), network utilities (curl, wget), or scripting interpreters (python). This behavior is often associated with malicious npm package installation or software supply chain compromise where post-install scripts are used to gain persistence or download secondary payloads.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
Detects instances where browser automation tools (e.g., Selenium, Puppeteer, Playwright) or headless browser instances initiate command-line interpreters or scripting hosts. This behavior is indicative of potential automated exploitation, such as browser-based attacks where a malicious script attempts to execute commands directly on the host operating system.
Detects attempts to bypass input sanitization in AI agent frameworks, specifically Semantic Kernel, by using Python bracket or subscript notation to access sensitive attributes or functions (e.g., __class__, __subclasses__, __import__, eval, exec). This technique is characteristic of filter injection attacks aiming to achieve remote code execution in AI agent environments.
Detects execution of JavaScript files using the Windows Script Host (wscript.exe or cscript.exe). This is a common technique used by attackers to execute malicious scripts, often delivered via phishing or as secondary payloads.
Detects instances where PowerShell is launched as a child process of WScript.exe or CScript.exe with suspicious command line flags intended to hide window visibility, bypass execution policies, or run in a non-interactive mode. This behavior is frequently used by adversaries to execute obfuscated or malicious scripts while minimizing user awareness.
Detects instances where the AnyDesk process spawns cmd.exe or executes a batch script, which is a common indicator of an attacker performing post-exploitation activities via a remote access session.
Detects malicious code within the BTree.prototype.set function designed to trigger a secondary payload (sharedLoad.min.js) at runtime. This behavior is intended to bypass npm install-script scanning by embedding the logic within legitimate-looking library code and using Node.js child_process spawns with hidden parameters to maintain persistence and execution.
This rule detects the presence of the malicious indexed-btree npm package by searching for its obfuscated runtime loader triggered via BTree.prototype.set. The malware attempts to spawn a detached Node.js process to execute a secondary payload (sharedLoad.min.js) instead of relying on standard installation scripts, allowing it to maintain persistence and bypass simple static analysis.
Detects the execution of Node.js processes where the command line contains references to specific strings potentially associated with malicious packages or libraries often used in supply chain attacks or obfuscated payloads.
Detects Node.js process executions that involve loading a suspicious JavaScript file named 'sharedLoad.min.js' or 'extended/sharedLoad.min.js'. The rule further flags instances where the process command line includes 'detached' and 'windowsHide' arguments, which are frequently used to execute Node.js scripts in the background without a visible window.
Detects the execution of Python interpreters from non-standard, user-writable directories (such as Public\Music) or using suspicious filenames. This behavior is indicative of threat actors abusing the Python Embeddable package to run disguised Python backdoors, such as the Chinotto malware family observed in APT37 operations, often staged via batch scripts or curl.
Detects execution of WMI or PowerShell queries by HTA, WScript, or CScript processes to gather system information such as OSLanguage, BIOS, or hardware identifiers. This behavior is indicative of environment-awareness checks used by the Casbaneiro/Ousaban banking trojan to identify sandbox or virtualization analysis environments before proceeding with the infection.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
This rule detects potential PowerShell script execution without spawning the standard powershell.exe process. It monitors for the loading of clr.dll and System.Management.Automation.dll into any process other than powershell.exe, which is a technique used by some malware families like SloppyRAT to execute PowerShell code directly within a compromised process memory space.
Detects the indexed-btree npm malware loader embedded in BTree.prototype.set that spawns a detached hidden Node.js child process and references sharedLoad.min.js
Detects the deletion of .zip files within the Public directory by VBScript or JScript interpreters (wscript.exe or cscript.exe). This pattern is often indicative of a malicious dropper or downloader that extracts a payload from a staged archive and subsequently removes the evidence to hinder analysis and forensics.
Page 28 of 191