Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
2
2
1
Categories
2
2
2
1
1
Platforms
3
2
1
1
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects use of macOS resource forks to hide malicious data
This rule detects network traffic containing the string "/..namedfork/rsrc" (case-insensitive) over TCP to port 22 (SSH). This pattern is indicative of an attempt to use macOS resource forks to hide payload data, a technique often employed by malware for defense evasion. The detection specifically targets traffic originating from and destined for the home network, suggesting an internal system attempting to exfiltrate or receive hidden data.
KQL Query
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
'This hunting query identifies a fork activity against a repository done by a user who is not the owner of the repo nor a contributes.'