Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,897
7,231
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule detects when a Node.js process accesses sensitive files associated with SSH configurations, private keys, or package manager credentials (such as .npmrc or .pypirc). Such behavior is highly unusual for legitimate web application processes and may indicate an attacker attempting to steal credentials or secrets from a compromised system.
Detects LampoRAT malware based on known file hash execution.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Detects the execution of 'sudo npm install -g apintergrationpost', a known command pattern utilized by the MYRA RAT. This pattern leverages sudo for elevated privilege installation via a malicious npm package hook, facilitating potential privilege escalation.
Detects the node.exe process deleting its own executing script file 'setup.cjs' located within an 'easy-day-js' node_modules directory. This behavior is indicative of the anti-forensics self-deletion mechanism used by the easy-day-js supply chain dropper to remove its footprint after executing a subsequent malicious payload.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects communication between a macOS host and the Telegram Bot API using the 'getUpdates' method. This behavior is indicative of the 'Gaslight' malware family using Telegram as a command-and-control (C2) channel via polling, typically characterized by repeated HTTP requests to 'api.telegram.org'.
Detects the Meow RAT malware attempting to identify the system locale and keyboard settings on macOS. This behavior is used by the malware to fingerprint the target environment and specifically avoid infection if the system is identified as belonging to CIS (Commonwealth of Independent States) regions.
Detects the use of osascript to spawn fake macOS system dialogs that mimic legitimate 'System Preferences' prompts to harvest user login passwords. This activity often involves AppleScript dialog commands combined with dscl authonly checks to validate the stolen credentials.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
Page 121 of 173