Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects connections to cryptocurrency mining pools
Detects installation of rootkit kernel modules for deep system hiding
Detects internal proxy connections used to relay C2 traffic through network
Detects use of WHOIS web services for domain property enumeration
Detects modification of macOS plist files to hide processes or enable autostart
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects process command lines that contain patterns indicative of obfuscated payload execution, specifically the combination of 'eval', 'base64', and '-d'. This technique is frequently used by adversaries to decode and execute memory-resident stages without dropping secondary payloads to disk.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Detects Node.js or Bun executing specific hidden setup files indicative of the Miasma payload being triggered by IDE configuration files (Cursor, Claude, Gemini, VSCode). This rule looks for process execution where the filename is 'node.exe', 'node', 'bun.exe', 'bun', or common shells ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh', 'zsh') and the command line contains specific Miasma payload patterns like '.github/setup.js', '.claude/setup.mjs', or 'bun run' with '.config/index.js'.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
This rule detects the use of the 'ditto' command-line utility on macOS for data staging and compression, specifically looking for executions that use compression flags (-c, -k) and target the /tmp/ directory. This behavior is indicative of information stealer malware like Amos Stealer, which may compress collected data before exfiltration.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects when AI agent processes establish listening connections on network ports, indicating potential unauthorized service exposure or lateral movement activity.
This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Page 139 of 174