Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
Detects unauthorized access to macOS Keychain for credential extraction
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
Detects Python transmitting a newly created archive or JSON collection through requests, urllib, aiohttp, or a custom socket. This behavior is associated with the InvisibleFerret malware.
Detects Python searching local vaults and configuration for password managers such as KeePass, 1Password, Bitwarden, or LastPass. This activity is associated with the InvisibleFerret malware.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects outbound network connections to 'seed1.getsession.org', a known Miasma Command and Control domain. This rule specifically looks for network events where the remote URL contains this domain, indicating potential C2 communication.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.
Detects the use of 'launchctl load' to activate the gh-token-monitor LaunchAgent persistence mechanism immediately after creation.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Identifies devices with FFmpeg installations below version 9.0 that include the vulnerable MagicYUV decoder (libavcodec), exposing the host to heap out-of-bounds write RCE via crafted AVI, MKV, or MOV files (CVE-2026-8461).
Detects automated execution of hidden workspace scripts triggered upon opening IDE folders, specifically looking for bash or sh processes executing 'vendor/run-update.sh' initiated by VS Code or Cursor.
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
Detects the creation, modification, or renaming of the 'com.finder.helper.plist' file in the '/Library/LaunchDaemons/' directory, which is a specific persistence mechanism used by the AMOS stealer malware. This rule specifically targets the root-level persistence method.
This YARA rule detects the presence of a credential stealer by identifying a cluster of file names commonly associated with Firefox profile data. The rule specifically looks for at least five out of seven distinct file names: 'key4.db', 'cert9.db', 'cookies.sqlite', 'logins.json', 'formhistory.sqlite', 'places.sqlite', and 'prefs.js'. These files are critical components of a Firefox profile, storing sensitive information such as encryption keys, certificates, cookies, login credentials, browsing history, and user preferences. The co-occurrence of these file names within a scanned target suggests an attempt to access, exfiltrate, or manipulate Firefox user data, often indicative of malware like credential stealers.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
This rule detects a multi-step execution chain where Node.js (or npm) spawns a shell process, which then launches Bun. This pattern has been observed in malicious packages to hide the final payload from simple scanners. It is crucial to review the full parent-child process tree for any alerts. Users should be questioned about recent software installations or clicked links, and security teams should be involved if the activity is suspicious.
Page 138 of 174