Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
Detects the staging and potential execution of Java deserialization payloads associated with the ysoserial CommonCollections5 (CC5) exploit, which leverages the BadAttributeValueExpException gadget chain.
Detects bash or sh executing install.sh from an OpenClaw skill directory, matching the alternate macOS and Linux GhostLoader bootstrap path. This activity is associated with the malicious OpenClaw skill distributing Remcos RAT and GhostLoader.
This rule detects network connections on port 443 made to common public DNS resolvers (1.1.1.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112) by processes other than known web browsers. This behavior is atypical for standard endpoint processes and may indicate the use of DNS-over-HTTPS (DoH) for command and control or data exfiltration to bypass network filtering.
A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects the installation of specific Chrome browser extensions associated with the 'BadBlocker' campaign. These extensions are known to request broad host permissions, allowing them to access data across all websites, which can lead to sensitive information theft, credential harvesting, or session hijacking.
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
Detects network, process, or command-line activity associated with the installation or update of malicious Chrome extensions linked to the BadBlocker campaign. The rule specifically monitors for known extension IDs: cmedhionkhpnakcndndgjdbohmhepckk (Adblock for YouTube), onomjaelhagjjojbkcafidnepbfkpnee (Adblock for Chrome), gekoepiplklhniacchbbgbhilidiojmb (AdBlock Suite), and ogcaehilgakehloljjmajoempaflmdci (Adblock for You).
Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.
Detects pip installing the benign-looking termncolor package together with colorinal. This dependency relationship was used to conceal delivery of platform-specific ZiChatBot droppers, as observed in campaigns attributed to OceanLotus (APT32). The rule specifically looks for command-line executions of pip or python with 'pip install' and the presence of 'termncolor', 'colorinal', or 'uuid32-utils' in the command line.
Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.
This rule detects activities associated with specific malicious browser extensions, often masquerading as ad blockers. It monitors for file and command-line references to the unique extension IDs associated with these malicious payloads and also alerts on DNS requests directed at C2 domains known to be used by these extensions.
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
A master aggregation capturing processes generating connections to multiple known malicious ports tied to specific campaigns, indicating potential C2 beaconing activity.
Identifies processes executing Base64 decoded commands where the parent script recently communicated with an AI endpoint, representing prompt-injected or AI-generated payloads.
Detects modifications to .git/hooks/pre-commit files across developer workspaces, which is a primary persistence mechanism ensuring payload re-execution on git commits.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
Page 124 of 173