Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Detects a code editor process (VS Code, VS Code Insiders, code-server) opening or reading the .git/config or .git/HEAD file, which may indicate a malicious editor extension harvesting private repository and CI/CD configuration data, as seen in the Open VSX "evil twin" extension campaign.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects a process accessing .git/config or .git/HEAD files followed by a network connection or HTTP request from the same agent within a short time window, consistent with the Open VSX 'evil twin' extension campaign harvesting private repository and CI metadata and exfiltrating it to attacker-controlled infrastructure.
Detects VS Code / Node.js processes associated with editor extensions making outbound HTTP requests that contain CI/CD environment variable names (e.g. GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, CIRCLECI, BUILDKITE, CODESPACES, GITPOD), consistent with the Open VSX 'evil twin' extension campaign that harvested private repository and CI/CD data from developer environments.
Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.
Detects installation of malicious "evil twin" Open VSX extensions impersonating AMD, Azure, or Salesforce that carry the tell-tale version 0.0.1 or 0.0.2, identified via file creation/write events in VS Code / Open VSX extension directories.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects a code editor process (VS Code, Cursor, Windsurf, VSCodium) reading the MachineGuid registry value followed within 3-8 seconds by an outbound network connection to a non-private IP from the same process on the same host, consistent with Open VSX evil-twin extensions harvesting developer machine identifiers and exfiltrating fingerprinting data.
Detects a shell process (sh, bash, cmd.exe, powershell.exe) spawned by a web application server process (java, node, python) that establishes an outbound connection to a non-private IP address, excluding known CI/CD and health-check command-line patterns — consistent with a reverse shell delivered via web application exploitation.
STAC4749 Golang Implant TLS Certificate with Hardcoded CA Issuer (loop-CA/connectify-CA/james-bond-CA)
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
SOCKS5 client no-auth handshake request to external host
Page 32 of 60