Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Correlates the downloading of the secondary Mach-O backdoor (.mainhelper) into the user's home directory as a hidden file.
Detects connections to cryptocurrency mining pools
Detects a persistent process creating similarly sized outbound transfers at regular intervals after staging local results, indicative of the Kazuar malware's exfiltration behavior. The rule identifies processes with significant outbound network traffic (bytes > 10000), aggregates this traffic over 15-minute intervals, and then looks for processes that exhibit consistent outbound activity with intervals between 10 and 20 minutes (600 to 1200 seconds).
Detects files or processes matching SHA256 indicators published by Google Threat Intelligence Group for the INFINITERED campaign. The hashes cover the help.php persistence component, credential harvesters, backdoors, and droppers. A match should be treated as a high-confidence indicator of compromise and investigated immediately.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
Detects removal and replacement of Chrome.app on macOS to bypass Manifest V3.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects Python scripts making outbound network connections directly to IP addresses without prior DNS resolution. This behavior can strongly indicate hardcoded Command and Control (C2) communication, where an adversary has embedded the C2 server's IP address directly into the script to bypass DNS-based security controls or to ensure connectivity even if DNS is compromised or unavailable. The rule filters out private IP addresses and aggregates connections by device and remote IP, flagging those with a low connection count (less than 10) to reduce noise from legitimate, high-volume bare-IP traffic.
Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.
Detects the use of curl with specific command-line flags (-kfsSL) commonly used by Amos Stealer to silently download its initial payload, bypassing TLS warnings and hiding output. This behavior is indicative of an adversary attempting to transfer tools or malware onto a system without user interaction or visible output.
This rule detects attempts to clean up artifacts associated with the Amos Stealer by monitoring for the deletion of known staging paths. Specifically, it looks for the execution of 'rm' commands targeting '/tmp/osalogging.zip' or '/tmp/sync'. This activity suggests an adversary is trying to remove traces of their presence after data exfiltration or staging.
Detects the execution of 'curl' with specific flags ('-kfsSL') often used for silent and insecure file downloads. This pattern has been observed in malware like Amos Stealer to download malicious payloads. The rule looks for 'curl' as the filename or at the beginning of the command line, combined with the specified flags and an HTTP/HTTPS URL.
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects command-line installation of VS Code extensions (.vsix) launched by script interpreters. Threat actors like UNK_DeadDrop use this technique to silently install malicious extensions via VBScript and CMD payloads.
Detects the creation or modification of VS Code tasks.json files outside of normal IDE or version control operations. Threat actors, such as North Korean groups, are weaponizing the "runOn: folderOpen" feature in tasks.json for auto-execution when a cloned repository is opened.
Identifies the payload invoking the native macOS security command-line utility to dump passwords and certificates from the user's Keychain, specifically when the initiating process is located in the /tmp/ directory, which is often used by malware for temporary execution.
This rule detects a malicious npm package attempting to read Claude MCP connection settings, which may contain sensitive information like API keys and server details. The theft of MCP configuration could allow attackers to impersonate AI integrations. If this rule triggers, the package should be removed, and any associated API keys should be rotated. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
Page 137 of 174