Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects headless browsers managed by AI agents making Cross-Site WebSocket Hijacking connections to localhost. Specifically, it looks for network connections initiated by processes with 'playwright' or 'MultimodalWebSurfer' in their command line, connecting to localhost (127.0.0.1 or ::1) on ports 8080 or 8081.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects the execution of 'osascript' with command-line arguments indicative of malicious activity, such as attempting to access locked icons, using 'dscl . authonly' for authentication, or displaying hidden dialogs for credential harvesting. This often points to AppleScript abuse for various attack techniques.
Detects the installation of Meow RAT persistence mechanisms on macOS by monitoring for the creation or modification of specific LaunchAgent or LaunchDaemon .plist files, particularly those named 'com.apple.accountsd.plist', and subsequent 'launchctl load' commands for these files. This rule identifies attempts to establish persistence by masquerading as legitimate system processes.
Detects suspicious execution of 'osascript' by processes that are not typically user-interactive, often indicative of C2 command dispatch or malicious AppleScript execution. The rule specifically looks for 'osascript' being spawned by processes other than common user applications (Finder, Terminal, iTerm2, etc.) or Apple-related processes, and checks for command-line arguments associated with executing shell commands via AppleScript or direct shell command execution patterns.
Detects instances where 'osascript' is used to execute commands that include suspicious keywords often associated with obfuscated or malicious scripts. This can indicate an attempt to run arbitrary code, potentially for initial access, execution, or persistence on macOS systems.
Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.
Detects the AMOS Stealer archiving collected data using the 'ditto' command with specific flags and output file names. This rule identifies the use of '-c', '-k', and '--sequesterRsrc' flags, along with '/tmp/osalogging.zip' or '/tmp/out.zip' as target archive names, which are characteristic of AMOS Stealer's data staging and archiving behavior.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Detects the spawning of shells (bash, sh) or utility processes (npx) as child processes of Amazon Q or VS Code extension host components. This activity is indicative of exploitation attempts involving malicious Model Context Protocol (MCP) server configurations within workspace environments, as identified by CVE-2026-12957.
Detects OAuth token theft via malicious redirect URI manipulation
Detects exfiltration of sensitive data pushed to GitHub repositories
Identifies Storm-1175 utilizing the rclone utility (often renamed) with MEGA or Mega-CMD configurations to exfiltrate vast data troves before encryption.
Correlates the creation of randomized staging directories /tmp/shub_ indicating SHub Stealer activity.
Detects the creation of specific staging paths utilized by AMOS to organize stolen artifacts before archiving.
This rule detects a rapid sequence of host profiling commands commonly used by the AMOS malware to gather system information, specifically to generate the hardware UUID of the victim machine. It looks for the execution of 'whoami', 'id', 'hostname', and 'ioreg' commands within a 10-second window, requiring at least three distinct commands from this set, with 'ioreg' being a mandatory component.
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
Page 136 of 174