Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects anomalous process execution patterns associated with supply chain compromises (specifically Miasma/Mini Shai-Hulud 'Phantom Gyp'), where node-gyp build processes or npm lifecycle scripts trigger the execution of unexpected scripts or unauthorized runtimes like Bun.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
This rule detects potentially unauthorized or suspicious command execution originating from AI development assistant processes such as Claude, Cursor, Amazon Q, or Node-based environments. It specifically monitors for the invocation of shell commands (e.g., bash, sh -c) or package managers (npx) that interact with sensitive AI assistant configuration files (e.g., .amazonq, mcp.json), which could indicate an adversary attempting to leverage AI integration paths for unauthorized command execution or persistent configuration manipulation.
Detects instances where the 'git clone' command is executed, followed by the creation of a configuration file at '.amazonq/mcp.json'. This pattern may indicate the setup or configuration of Amazon Q developer tools on an endpoint, which could be abused for unauthorized access or information gathering if performed by an unauthorized user or process.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects when development tools such as VS Code, VS Code OSS, or Node.js spawn a shell (bash/sh) to execute network-related commands (aws, curl, wget, npx). This behavior is characteristic of an adversary leveraging a developer's environment to download payloads, interact with cloud resources, or perform reconnaissance.
Identifies the use of the macOS ditto utility to compress stolen datasets into a single archive, specifically preserving resources, as observed in AMOS malware activity.
Detects the script escalating privileges using the stolen password via sudo to strip quarantine extended attributes from the payload.
Detects macOS Terminal (bash/zsh) retrieving 'loader.sh' or 'payload.applescript' directly from the ClickFix attacker infrastructure, indicating potential compromise related to the ClickFix campaign.
Detects the final curl command transmitting archived credentials to a remote C2 via a multipart form-data upload, specifically looking for curl commands that use '-X POST' and '-F file=@/tmp/.*.zip' to upload a zip file from the /tmp directory.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Identifies the AppleScript stealer validating the phished user password locally using the dscl . -authonly command.
Detects curl POST requests sending JSON telemetry to attacker endpoints post-infection, specifically looking for patterns associated with the ClickFix campaign.
Identifies the creation of a LaunchAgent property list masquerading as 'com.google.keystone.agent.plist'. This behavior is associated with the ClickFix campaign, which uses fake macOS utilities to deliver infostealers.
Detects the creation of the .agent shell wrapper file designed to supervise and restart the .mainhelper backdoor process.
Identifies the first-stage script downloading the Mach-O binary payload directly into /tmp/helper or /tmp/update using 'curl'.
Correlates the stealer invoking system_profiler via osascript to search for virtualization strings to halt execution in sandboxes.
Correlates the creation and immediate deletion of the trin.tar.gz archive handled by the Python temporary-directory context manager.
Page 132 of 173