Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,627 detections
Filters
Last updated
All Time
Detection languages
1,752
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,489
1,153
779
528
515
Platforms
39,908
7,245
6,529
3,864
3,627
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
573
523
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.
Detects macOS.Gaslight malware activity through two branches: direct hash matches of known binaries and the spawning of Python subprocesses with specific command-line arguments indicative of data collection or archiving. The Python subprocess detection looks for Python scripts being executed from '/tmp/' or '/Library/' directories with arguments related to browser data collection, keychain access, or archiving operations.
Detects suspicious attempts to access macOS Keychain or browser credentials (Chrome, Firefox) using 'osascript' or 'security' command-line utilities. This rule identifies patterns indicative of credential dumping or access, such as unlocking keychains, finding generic passwords, or accessing browser-specific credential files.
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
This rule detects suspicious access to macOS Keychain files or the use of the 'security' utility to manipulate keychains. It specifically looks for 'osascript' accessing keychain-related paths, the 'security' utility using commands like 'unlock-keychain' or 'find-generic-password', or common shell utilities ('cp', 'cat', 'sh', 'bash', 'zsh') accessing keychain database files. This activity is often indicative of credential access attempts.
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
Detects suspicious child processes spawned by VS Code extension hosts (node.exe, code.exe, code-server, cursor) that indicate potential abuse, possibly related to WASM syscall/js bridge exploitation. The rule specifically looks for common command-line patterns used for downloading and executing payloads, such as those seen in GLASSWORM WASM loader attacks.
This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.
Detects osascript execution for macOS system interaction
This rule detects attempts to access macOS Keychain credentials or web browser stored credentials using the 'security' command-line utility. It specifically looks for 'security unlock-keychain' and 'security find-generic-password' commands, with the latter also checking for common browser names like Chrome, Brave, and Microsoft Edge. This activity is indicative of an adversary attempting to dump credentials from the system.
This rule detects the execution of AppleScript (osascript) to display fake System Preferences dialogs and the use of 'dscl . authonly' to validate credentials, which is indicative of the Meow RAT attempting to harvest macOS login passwords. The rule specifically looks for keywords in the command line that suggest a fake dialog (e.g., 'display dialog', 'LockedIcon.icns', 'System Preferences', 'hidden answer', 'default answer') or authentication validation via dscl.
Detects malicious installer packages with custom actions for persistence
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
Detects theft of browser session cookies for account takeover
Detects spinning up of virtual machines to conduct malicious activity in isolation
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects network connections to the Telegram API, specifically to the /sendMessage or /getUpdates endpoints. This activity can be indicative of command and control (C2) communication or data exfiltration using Telegram as a covert channel.
Page 117 of 173