Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,627 detections
Filters
Last updated
All Time
Detection languages
1,752
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,489
1,153
779
528
515
Platforms
39,908
7,245
6,529
3,864
3,627
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
573
523
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects abnormal termination, crash, or error messages related to the 'sharingd' process on macOS. 'sharingd' is a daemon responsible for various sharing features including AirDrop, Handoff, and Instant Hotspot. Unexpected errors or crashes within this process may indicate service instability, potential exploitation attempts, or abnormal interactions with sharing services.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
Detects outbound network connections (DNS queries or direct IP connections) to a set of known domains frequently associated with software cracking tools, unauthorized installers, or potentially unwanted programs (PUPs).
This rule detects the creation of files with naming conventions associated with common document-based phishing lures (e.g., invoices, fiscal documents) or DNS requests to specific domains (e.g., pages.dev) frequently leveraged by attackers for hosting malicious content.
Detects execution of specific shell commands (shell, kill, upload, stop) often associated with remote access trojans or backdoors. This rule monitors process creation events where these specific command verbs are present in the command line of either the process itself or its initiator, commonly seen in scenarios where a backdoor receives commands via system execution primitives like execvp() or posix_spawnp().
Detects macOS binaries that employ dynamic API resolution by using 'dlsym' and 'dlopen' to resolve sensitive functions like 'SecTrustSetAnchorCertificatesOnly' or 'IOPMAssertionCreateWithName' at runtime. This technique is often used to avoid static analysis by bypassing import table monitoring and string extraction.
Detects the execution or network communication involving python-build-standalone, a tool often used by developers to deploy portable Python environments. In an environment, the unauthorized use of this tool may indicate an adversary attempting to deploy their own Python interpreter to execute malicious scripts, effectively bypassing environment-specific restrictions or configurations.
Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.
Detects network communication with known malicious domains associated with fraudulent or malicious 'Adblock for YouTube' browser extensions, as well as suspicious process command lines related to main world script injection performed by these extensions.
This rule detects suspicious activity associated with the Bun runtime after an npm package install. It flags instances where Bun, or download utilities (curl/wget) fetching 'bun.sh', are spawned from Node.js-related processes (npm, node, node-gyp) particularly when located in common temporary or cache directories, indicating potential supply chain compromise or unauthorized runtime deployment during build processes.
This rule detects the execution of 'hdiutil' to attach a disk image with the '-nobrowse' flag, initiated by various scripting interpreters (bash, zsh, python, etc.) or terminal applications. This pattern is frequently used by adversaries to silently mount malicious payloads or tools contained within disk images while bypassing user interaction.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
Detects macOS.Gaslight DPRK-aligned implant registering a LaunchAgent plist using the com.apple.system.services.activity label to masquerade within Apple's com.apple.* namespace for persistence. Key behavioral indicators include file writes to ~/Library/LaunchAgents with the spoofed label and use of __NSGetExecutablePath for binary path resolution.
Detects the use of legitimate command-line utilities such as rclone, AWS CLI, AzCopy, curl, and wget to upload data to cloud storage endpoints, which is a common technique used for data exfiltration.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Detects high volumes of network connections initiated by common file sharing processes such as AirDrop, sharingd, NearShare, or QuickShare. This behavioral pattern, characterized by a large number of successful connections or numerous unique remote IP addresses, may indicate unauthorized mass data collection, reconnaissance, or potential lateral movement attempts.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.
Page 102 of 173