Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
Detects the creation or modification of suspicious macOS Launch Agents or Launch Daemons, specifically looking for patterns associated with the 'macOS.Gaslight' malware (e.g., 'com.apple.system.services.activity') or the creation of Launch Agents in user directories by processes masquerading as browser renderers (indicated by '--type=renderer' in the command line, excluding legitimate browsers). This rule aims to identify persistence mechanisms used by malware.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects suspicious process activity involving common macOS command-line tools (osascript, sh, bash, zsh, cp) attempting to access sensitive browser data (Chrome, Edge login data, cookies, web data) or macOS keychain files. This rule specifically excludes activity initiated by the browsers themselves to reduce false positives.
Matches the hardcoded VAPID Public Key string used by the extension to bypass browser sandboxes and wake the service worker, indicative of the SNOWBELT malware's command and control mechanism.
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
This rule detects the use of 'curl' to perform HTTP PUT requests with binary data, a technique often employed by malware like Amos Stealer for data exfiltration. It specifically looks for command-line arguments '-X', 'PUT', and '--data-binary' in 'curl' process executions.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the main file executed.
Detects shell/script execution from .git/hooks/ paths, especially when spawning network-connected or unusual child processes. This activity is indicative of Lazarus Group exploiting Git Hooks for persistence and credential theft within developer environments.
Correlates the malware attempting to permanently disable macOS system-wide Gatekeeper functionality (spctl --master-disable).
Identifies the payload establishing reboot persistence by writing a .plist to the user's ~/Library/LaunchAgents directory and activating it using 'launchctl load'.
Correlates the execution of a script from a cloned repository accessing developer credential stores (SSH keys, AWS profiles) within a tight time window. This rule specifically looks for file access events on common credential files (id_rsa, credentials, config) within sensitive directories (.ssh, .aws, .kube) that are initiated by a process whose command line contains keywords often associated with development activities or social engineering lures (interview, test, assignment).
Detects the final curl command utilized by AMOS or ClearFake transmitting the archived credentials to the remote C2 via a multipart form-data upload.
Detects the malicious Terminal execution sequence where base64 encoded text is piped into bash to fetch the first-stage AMOS script.
Identifies the AMOS stealer validating and redirecting the captured plain-text macOS password into a hidden .pass file.
Detects unauthorized processes aggressively reading Chromium and Safari browser database files (Login Data, Cookies, Web Data) on macOS, which is indicative of credential stealing attempts. The rule specifically looks for file access events to browser profile directories where these sensitive files are stored, excluding legitimate browser processes.
This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.
Correlates the download of a payload using 'curl' to the /tmp/ directory with an immediate 'chmod +x' command on a file in the /tmp/ directory, making it executable. This sequence of events is indicative of preparing a downloaded script or binary for execution, often seen in the initial stages of infostealer attacks on macOS.
Page 129 of 173