Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
462 detections
Filters
Last updated
All Time
Detection languages
298
91
19
18
17
Contributors
217
125
23
14
13
Categories
198
167
67
55
51
Platforms
363
165
83
10
7
Products / Services
10,665
9,773
6,705
4,421
3,749
462
MITRE Techniques
201
124
113
80
47
CVEs
4
3
3
2
1
Detects command line activity indicative of probing endpoint detection and response (EDR) software directories such as CrowdStrike, Falcon, Carbon Black, and SentinelOne. The Miasma malware probes these exact paths to fingerprint host defenses before executing its credential theft module.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
Detects the creation of scheduled tasks originating from processes executing out of temporary or download directories. This behavior aligns with the persistence mechanisms of the SilverGorilla .NET dropper, which is typically delivered via recruitment-themed phishing archives.
Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
Identifies processes launched with the __DAEMONIZED=1 environment variable. This specific marker is used by the vpmdhaj malicious npm packages to spawn their stage-2 credential harvesting payload as a detached process, allowing it to survive parent termination.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
This rule detects the creation, modification, or renaming of directories related to the malicious 'plain-crypto-js' npm package within a 'node_modules' folder. This activity is indicative of a supply chain compromise where a legitimate package (Axios) was found to include this malicious dependency.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects the modification of the 'check_integrity.sh' script to replace 'exit 1' with 'exit 0'. This is a specific defense evasion technique used by the RESURGE malware on Ivanti Connect Secure devices to ensure the compromised system always appears healthy during integrity scans.
Page 10 of 22