Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
59
31
19
2
2
Contributors
20
16
12
11
10
Categories
57
54
14
14
11
Platforms
94
34
26
4
2
Products / Services
28
27
13
6
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
Detects anomalous behavioral patterns where an AI agent process (e.g., Claude Code, Cursor, Aider) performs multi-category discovery of its own runtime environment, plugins, and host configuration. The rule identifies agents that trigger processes spanning at least three distinct discovery categories (Network, File/Plugin, Software, or System) within a short timeframe, indicating potential reconnaissance of agent-authorized capabilities and tools rather than standard host exploration. Covers T1082, T1518, T1083, T1016
Detects anomalous behavioral patterns where an AI agent process (e.g., Claude Code, Cursor, Aider) performs multi-category discovery of its own runtime environment, plugins, and host configuration. The rule identifies agents that trigger processes spanning at least three distinct discovery categories (Network, File/Plugin, Software, or System) within a short timeframe, indicating potential reconnaissance of agent-authorized capabilities and tools rather than standard host exploration. Covers T1082, T1518, T1083, T1016
Detects host reconnaissance activity performed by PureLog Stealer, characterized by the execution of system administration tools (e.g., wmic, reg, systeminfo) spawned as child processes from .NET LOLBins (e.g., msbuild, installutil, regsvcs). This behavior indicates an adversary performing discovery of system configuration and environment details.
Detects rapid, multi-category system and network enumeration performed by AI-assisted development tools (e.g., Cursor, Claude, ChatGPT). The rule triggers when an AI agent process performs a comprehensive scan of the host environment, specifically covering machine/OS identity, network configuration, process listings, installed software, and access to sensitive credential files within a 10-minute window. It requires at least 5 distinct discovery categories and 6 total events to reduce noise from routine debugging. Covers T1082, T1016, T1057, T1518
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects registry query operations targeting the App Paths registry keys for Google Chrome and Microsoft Edge by processes other than the browsers themselves. This behavior is often indicative of reconnaissance or software discovery activities where an adversary attempts to identify installed browser locations, which may be a precursor to browser-based attacks such as credential theft or browser hijacking.
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Detects enumeration of installed applications via .desktop files by a process outside known desktop-environment binaries, correlated with a subsequent persistence-related file write, matching the botking implant's discovery-then-persist behavior.
This rule detects the execution of the Unisoc/Sprd 'EngineerModeActivity' via ADB shell on Android devices. Invoking this activity enables diagnostic modes and debug logging, which are often used by threat actors to facilitate exploitation, reverse engineering, or the collection of sensitive crash dump information for modem-related research.
Detects the malicious Open VSX "recon" extension variant checking whether its own extension ID is referenced in the workspace devcontainer.json or .vscode/extensions.json to determine if the install was configuration-driven versus human-initiated
Detects HTTP network traffic containing the endpoint's local hostname transmitted within 30 seconds of a process starting, consistent with 'evil twin' Open VSX extensions that harvest developer environment metadata immediately upon activation.
Detects a code editor process (VS Code, VS Code Insiders, code-server) opening or reading the .git/config or .git/HEAD file, which may indicate a malicious editor extension harvesting private repository and CI/CD configuration data, as seen in the Open VSX "evil twin" extension campaign.
Detects a process accessing .git/config or .git/HEAD files followed by a network connection or HTTP request from the same agent within a short time window, consistent with the Open VSX 'evil twin' extension campaign harvesting private repository and CI metadata and exfiltrating it to attacker-controlled infrastructure.
Detects VS Code / Node.js processes associated with editor extensions making outbound HTTP requests that contain CI/CD environment variable names (e.g. GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, CIRCLECI, BUILDKITE, CODESPACES, GITPOD), consistent with the Open VSX 'evil twin' extension campaign that harvested private repository and CI/CD data from developer environments.
Detects folder-existence checks for Ledger Live/Wallet, cryptocurrency wallet directories (atomic, Exodus, Guarda, KeepKey, BitBox02), and Signal Desktop under %APPDATA%, correlated with a WMI AV-discovery query from the same process within 15 minutes, consistent with CountLoader's crypto-wallet reconnaissance.
Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.
Detects a process rapidly accessing a large number of distinct files within VS Code or Open VSX extension directories in a short time window, consistent with reconnaissance of installed extensions such as that performed by malicious 'evil twin' extensions harvesting developer metadata.
Page 2 of 6