Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,627 detections
Filters
Last updated
All Time
Detection languages
1,752
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,489
1,153
779
528
515
Platforms
39,908
7,245
6,529
3,864
3,627
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
573
523
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Detects Node.js processes being executed with specific require flags or environment variables, while having parent processes or command-line arguments indicative of Flowise integration. This behavior is often associated with the execution of custom MCP (Model Context Protocol) tools or extensions within a Flowise workflow, which could potentially be abused for unauthorized operations or persistence.
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Detects the presence of malicious artifacts associated with the RoguePlanet campaign by ShinyHunters and Chaotic Eclipse, including specific malware families (BlueHammer, RedSun, UnDefend, Bluekit) and libpwn exploit harness components related to CVE-2026-55200.
Detects instances where processes associated with Claude AI (e.g., node, shell) spawn suspicious child processes such as Python interpreters, pip package managers, or shell scripts (sh, bash) with command-line arguments indicative of AI-driven project initiation, package installation, or automated setup tasks. This pattern is characteristic of AI-based agents executing code or performing automation on a developer workstation.
Detects the resolution of DNS TXT records using dig, followed by piping the decoded base64 output directly to bash for execution. This technique is characteristic of fileless payload delivery and remote command execution, specifically observed in the Axiom indirect prompt injection attack chain.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Cloud extortion group exploiting exposed credentials and storage
Fraud framework powering scam domains for crypto and gambling schemes
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
This rule monitors for suspicious activity associated with npm or Node.js processes. This includes potential credential misuse during npm publish or login, unauthorized build-time execution via node-gyp, and the use of unconventional preinstall/postinstall hooks that spawn external binaries or scripts, which are often indicative of software supply chain attacks.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Page 100 of 173