Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects suspicious activity related to the Sapphire Sleet malware, specifically its technique of traversing Google Chrome or Brave profile directories to extract and compress Web3 wallet extensions. It correlates file access events on specific browser extension paths with process events where archiving tools like 'zip' or 'tar' are executed.
Detects the payload stripping extended properties (xattr -c) to bypass macOS Gatekeeper, followed by immediate execution of the stripped file. This behavior is associated with the 'ClickFix' campaign.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the referenced Check Point research.
Detects network requests to the BadBlocker (AdBlock for YouTube) infrastructure that fetch malicious scriptlet rules. These rules are designed to leverage Chrome's scripting API to execute arbitrary JavaScript in the 'MAIN' world of web pages, effectively bypassing Content Security Policy (CSP) protections to inject unauthorized content.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
Detects potentially unauthorized or suspicious child process execution originating from IDEs associated with Amazon Q/CodeWhisperer. The rule monitors for common shell execution (bash, sh, node) or AWS-related command-line activity that may indicate credential harvesting or exfiltration via IDE extensions.
This rule detects the creation of a 'mcp.json' configuration file within an '.amazonq' directory shortly after version control system operations such as 'git clone', 'git pull', 'npm install', or 'pip install'. This activity may indicate an attempt to configure or persist unauthorized developer tools or malicious assistant configurations within a development environment.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects modifications or creations of manifest.json files within specific directories associated with a browser extension. This behavior is often indicative of the installation or tampering of browser extensions by malicious actors to establish persistence, perform credential theft, or execute unauthorized actions within the browser context.
This rule detects potential unauthorized access to AWS credentials by monitoring process creation events involving the 'get-caller-identity' command. It identifies scenarios where AWS access key environment variables are accessed or manipulated, and monitors common shell or node processes executing commands to query AWS identity information, which may indicate credential exfiltration or reconnaissance by an attacker.
Detects the execution of AWS STS 'get-caller-identity' commands via a network utility (curl) initiated by common development tools like VS Code, node, or amazonq-lsp. This behavior is indicative of potential cloud credential theft or reconnaissance performed through a compromised developer environment.
Detects network communication associated with BeepRAT, specifically identifying direct TCP connections to a known command-and-control IP address on a non-standard port or DNS requests directed at a specific malicious domain.
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.
Detects the execution of Node.js processes initiated by or related to the Flowise low-code AI platform, specifically where the --require flag is used. This pattern may indicate the loading of arbitrary JavaScript code or modules into the Node.js runtime, which could be indicative of malicious code injection or exploit activity within the Flowise environment.
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
Page 125 of 173