Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects C2 configuration retrieval via Pastebin and similar dead drop services
Detects downloads of typosquatted packages from npm or PyPI
Detects downloads of typosquatted packages from npm or PyPI
Detects addition of malicious login items on macOS for user-context persistence
This rule detects the execution of script interpreters (such as PowerShell, cmd, bash, python, etc.) where the command line contains non-ASCII characters, specifically Cyrillic, Arabic, or Chinese Unicode characters. This pattern can be indicative of obfuscation techniques used by adversaries to evade detection or to target specific regions.
This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects use of macOS resource forks to hide malicious data
Blockchain eth_call Command Resolution
Cortex XDR
This rule detects JSON-RPC 'eth_call' usage originating from a non-browser process, which could indicate dynamic command or address resolution related to blockchain interactions. The XQL view retains actor and causality fields to aid in investigation.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Detects delivery of malicious dylib files for macOS library hijacking
Detects VNC connections used for visual remote desktop lateral movement
Links the execution of the initial setup.mjs payload to network traffic bound for audit.checkmarx.cx. This rule detects the execution of 'setup.mjs' via 'bun' followed by network communication to 'audit.checkmarx.cx' within a 10-minute window, indicating potential supply chain compromise activity.
Detects when non-Node.js scripts, specifically Python or Bash/Shell, modify or create a 'package.json' file. This activity can indicate an attempt to silently inject malicious dependencies into clean repositories, a technique observed with malware like Miasma.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
Detects outbound network connections to 'git-tanstack.com', a typosquatted domain identified as part of the Miasma npm supply chain attack, indicating potential command and control communication.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.
Page 141 of 174