Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects unauthorized access to the .npmrc file by unusual processes. Miasma targets this file to hijack NPM publishing rights and propagate supply chain attacks. The rule specifically looks for file access events on '.npmrc' where the initiating process is not a known legitimate NPM-related tool like 'npm', 'node', 'bun', or 'yarn'.
Identifies execution of the Python credential stealer script named detect_malware.py, associated with the UNK_DeadDrop phishing campaign.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from downloaded files. It specifically looks for HTTP responses containing the string 'com.apple.quarantine' in the file data, indicating a potential attempt to modify or remove this attribute during or after a download.
Detects creation of macOS Launch Agent plist files for persistence
Detects downloads of executable scripts directly from raw GitHub URLs
Detects deployment of macOS startup item plist files for persistence
Detects queries to internet-wide scan databases for target infrastructure reconnaissance
Detects legitimate software deployment tools used for remote execution
Detects addition of malicious login items on macOS for user-context persistence
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule flags a notarised macOS Flutter application whose web view can trigger command execution. Apple notarisation does not guarantee good intent. Investigate any unfamiliar app with this pattern. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule catches a preinstall script running an obfuscated index.js before the main install completes. Preinstall runs automatically without user consent. Never ignore preinstall additions in dependency updates. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects dynamic domain resolution patterns used for C2 infrastructure rotation
Detects abuse of macOS XPC services for inter-process execution
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by JavaScript runtimes (like node or bun). This activity may indicate a supply chain backdoor attempting to establish persistence within a project by modifying development environment configurations.
This rule flags many npm republications from an account soon after suspicious token activity. Stolen maintainer tokens cause rapid malicious releases. Lock the account and audit download stats. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects download of malware source code from code repositories
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Page 142 of 174