Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects the installation of a LaunchAgent persistence mechanism on macOS. It specifically looks for the creation of a property list (.plist) file within the '~/Library/LaunchAgents/' directory, combined with the execution of the 'launchctl load' command, which is used to load and activate LaunchAgents. This technique is commonly used by malware, including infostealers, to establish persistence and survive system reboots.
Hunts for the stealer explicitly utilizing xattr -c to strip the com.apple.quarantine extended attribute, bypassing Gatekeeper execution protections.
Identifies process execution patterns matching the open-source nord-stream tool, abused by the actor to steal GitHub Actions secrets.
Identifies a backdoored model's payload executing post-deserialization to read developer secrets (SSH keys, AWS credentials, NPM tokens) and exfiltrate them.
Detects a network beacon triggered strictly during model initialization. If a Python process loads a model file and immediately establishes an outbound TCP connection to an unknown IP, it indicates an embedded payload phoning home.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.
Detects deployment of malicious LaunchDaemon plist files for privileged persistence
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects outbound network traffic from common web browsers (Chrome, Edge, Brave, etc.) to the typosquatted domain 'perplexity-ai.online'. This rule identifies behavior associated with a malicious browser extension ('Search for perplexity ai') that exfiltrates keystrokes and search queries captured via the browser's Omnibox functionality to an attacker-controlled server.
Detects AMOS malware forking a child process, using setsid to detach from the Terminal session, and then killing the Terminal window via killall Terminal to evade parent-process tracking. This is a key behavioral indicator of the Atomic macOS Stealer delivered via ClickFix campaigns.
Detects network traffic over port 6757, which is indicative of PureHVNC command and control (C2) communication.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
Detects a user mounting a deceptive .dmg file (e.g., posing as a crypto wallet or developer tool) resulting in the immediate execution of a hidden binary. The rule specifically looks for 'hdiutil attach' followed by a process execution from within a mounted volume that matches a common application or shell script path.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Hunts for curl or wget pulling secondary stage obfuscated payloads from Pastebin or GitHub Gists initiated by developer tools.
Detects potential credential theft activity where a user or compromised process executes shell commands to inspect environment variables, AWS credential files, or project configuration files (e.g., .env) for sensitive secrets such as API keys and access tokens.
Detects the creation or modification of '.env' files within '.gemini' directories, often found in CI/CD pipelines or developer environments. This activity may indicate an attempt to inject malicious environment variables to hijack the execution flow of the Gemini CLI or related tooling.
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.
Page 127 of 173