Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,894
7,228
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Correlates local LLM execution engines (Ollama, LM Studio) unexpectedly spawning command shells, a strong indicator of successful prompt execution payloads.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects instances where a process associated with the 'brand-landingpage' AI agent or processes involving scripts from 'stitch-design.ai' spawn child processes, potentially indicating malicious activity leveraging the agent's runtime permissions.
Detects the execution of a Python-based collection module associated with the Gaslight malware on macOS. The module performs reconnaissance by enumerating system information using 'system_profiler' and running processes via 'ps aux', followed by the collection of sensitive data including browser files and the login keychain.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Detects the execution of osascript spawned directly from the Terminal application, a pattern identified in Meow RAT campaigns using ClickFix social engineering lures to execute malicious AppleScript in-memory.
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects unauthorized access to cloud provider credential files (AWS, GCP, Azure) by potentially suspicious processes. It specifically monitors processes such as node.exe, npm, python, bash, or binaries running from temporary directories (/tmp, %TEMP%) while excluding legitimate CLI tools.
Detects unauthorized access to browser credential storage files (e.g., Login Data, Cookies, Local State) by suspicious non-browser processes such as node.exe, powershell.exe, or wscript.exe. This activity is often associated with infostealer malware, particularly in supply chain attacks where malicious scripts attempt to dump browser-saved credentials or session cookies.
Identifies execution of the Linux/macOS bash cradle used by GLASSWORM's WASM loader. It looks for curl fetching the specific OS path structure ('/linux/i/_' or '/darwin/i/_') and piping to bash.
Detects the execution of the macOS 'ditto' command used to compress and stage files into the /tmp directory, specifically looking for the creation of zip archives. This behavior is associated with Amos Stealer prior to data exfiltration.
Detects use of Discord webhooks for covert C2 or data exfiltration
This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.
This rule detects the execution of multiple common macOS utilities ('ps', 'system_profiler', 'sw_vers', 'sysctl', 'uname') with specific command-line arguments often used for system information discovery. The rule identifies instances where these commands are executed by a single initiating process, excluding common shell processes, and flags executions originating from suspicious temporary or library paths.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
Detects activity associated with the macOS.Gaslight credential stealer, specifically focusing on Python processes accessing the login.keychain-db, browser credential stores, creating a 'collected_data.zip' archive, and executing security or reconnaissance commands. This rule identifies file events (creation, modification, read, copy) related to keychain and archive staging, as well as process events involving the 'security' command for password extraction and 'ps' or 'system_profiler' for system reconnaissance, all initiated by Python.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
This rule detects attempts to enumerate keyboard input sources or search for Russian keyboard layouts on macOS systems. This activity can be indicative of an adversary performing a 'geofence' check to determine the system's locale or origin, potentially to avoid targeting specific regions.
Page 133 of 173