Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,897
7,231
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Infostealer distributed via fake open-source tool impersonation sites
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
MINIRAT C2Beacon
YARA
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
Photo-themed ZIP phishing campaign dropping a Node.js implant
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Fraud framework powering scam domains for crypto and gambling schemes
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
Identifies bash scripts leveraging 'chmod +x' inside '/tmp' or '/Users/Shared' to make a downloaded Mach-O payload executable. This activity is associated with the Sapphire Sleet threat group.
Detects unusual internal SSH connections between private IP addresses that are not initiated by common, trusted administrative tools (like ssh.exe, putty.exe, etc.). The rule aggregates these connections by source and host to identify potential lateral movement.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
macOS malware used by JINX-0164 against cryptocurrency developers
Page 119 of 173