Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
17
7
4
4
3
Contributors
11
8
7
2
2
Categories
9
8
7
5
5
Platforms
12
11
7
5
4
Products / Services
6
5
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
1
IDS Classtypes
1
1
1
IDS Protocols
3
Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.
Detects instances where a Node.js process spawns another Node.js process as a child. This behavior is often associated with malicious npm packages attempting to evade detection during runtime execution or executing secondary malicious payloads.
Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. This includes detection of kit-specific fingerprinting scripts (class_identifier.php), use of specific server banners (openresty), unauthenticated geolocation lookups (api.country.is), setting of geolocation cookies, and proxying of requests to Microsoft OAuth endpoints.
Detects execution of commands used to modify critical Android system settings, such as enabling accessibility services, developer options, or wireless debugging. These commands are commonly associated with the use of the Android Debug Bridge (ADB) to facilitate unauthorized device control, persistence, or configuration changes indicative of malicious activity or post-exploitation.
Detects the malicious Open VSX "recon" extension variant checking whether its own extension ID is referenced in the workspace devcontainer.json or .vscode/extensions.json to determine if the install was configuration-driven versus human-initiated
Detects HTTP network traffic containing the endpoint's local hostname transmitted within 30 seconds of a process starting, consistent with 'evil twin' Open VSX extensions that harvest developer environment metadata immediately upon activation.
Detects a code editor process (VS Code, VS Code Insiders, code-server) opening or reading the .git/config or .git/HEAD file, which may indicate a malicious editor extension harvesting private repository and CI/CD configuration data, as seen in the Open VSX "evil twin" extension campaign.
Detects a process accessing .git/config or .git/HEAD files followed by a network connection or HTTP request from the same agent within a short time window, consistent with the Open VSX 'evil twin' extension campaign harvesting private repository and CI metadata and exfiltrating it to attacker-controlled infrastructure.
Detects VS Code / Node.js processes associated with editor extensions making outbound HTTP requests that contain CI/CD environment variable names (e.g. GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, CIRCLECI, BUILDKITE, CODESPACES, GITPOD), consistent with the Open VSX 'evil twin' extension campaign that harvested private repository and CI/CD data from developer environments.
Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.
Detects installation of malicious "evil twin" Open VSX extensions impersonating AMD, Azure, or Salesforce that carry the tell-tale version 0.0.1 or 0.0.2, identified via file creation/write events in VS Code / Open VSX extension directories.
Detects host fingerprinting and geolocation activity performed by the Lambsys/procq cryptominer. The rule identifies processes like curl or wget querying external IP intelligence services (ipinfo.io, ip-api.com) when associated with suspicious binary paths or spawned by known miner processes.
Detects the execution of VILE ransomware by correlating the launch of the binary with the creation of specific artifacts used for system information discovery, specifically timezone-based geofencing and anti-analysis configurations.
Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.
Detects the Meow RAT malware attempting to identify the system locale and keyboard settings on macOS. This behavior is used by the malware to fingerprint the target environment and specifically avoid infection if the system is identified as belonging to CIS (Commonwealth of Independent States) regions.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects querying of the NLS/Language registry key, which is often used by Remote Access Trojans (RATs) like VenomRAT and AsyncRAT for system profiling and reconnaissance. The rule specifically looks for processes other than common system processes (svchost.exe, explorer.exe) accessing this registry key.
Detects system language and locale queries used to validate attack targets
Page 1 of 2