Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects browser processes making DNS queries or network connections to BNB Smart Chain RPC endpoints (and related EVM-compatible chain RPCs). This technique is a signal for EtherHiding-style attacks where malicious JavaScript injected into compromised websites queries smart contracts for payload retrieval. This generalizes beyond ClearFake to catch UNC5342 (North Korean DPRK) and other EtherHiding adopters documented since October 2025.
Detects command-line attempts to access, dump, or export macOS Keychain data using the 'security' utility. This behavior is commonly exhibited by infostealers, such as MacSync Stealer, targeting saved passwords, cryptocurrency wallets, and developer credentials.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects the execution of the GitHub CLI command used to print the active authentication token, which is abused by the Shai-Hulud worm to steal developer credentials.
Detects the destructive command line used by the Miasma campaign's dead man's switch to wipe the user's home directory upon token revocation. Specifically looks for 'rm -rf ~/; rm -rf ~/Documents' executed by 'rm' or 'rm.exe'.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects enabling Hide500Users in com.apple.loginwindow preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.
This rule detects attempts to modify the Info.plist file on macOS systems to include 'LSUIElement' with a value of '<true/>'. This modification can be used by malware or unwanted applications to hide their presence from the macOS Dock and menu bar, effectively bypassing user detection and making the application run as a background process. The rule specifically looks for these two content strings within HTTP file data flowing to the client.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Detects network connections attempting to download the specific Bun v1.3.13 archive from the oven-sh GitHub repository, which is used by the stage 3 bootstrapper in the Miasma npm malware campaign.
Detects the execution of curl on macOS using a hardcoded Catalina user agent (Mac OS X 10_15_7) and silent/fail-fast flags (-fsSL). This pattern correlates with the macOS terminal payload delivery mechanism used in the ClearFake/ClickFix campaign.
Detects instances where node or Electron processes are executed with the ELECTRON_RUN_AS_NODE environment variable set to 1. This technique is used by UNK_DeadDrop to turn an editor into a plain Node.js interpreter for stealthy payload execution.
Detects execution of AppleScript of the macOS scripting language AppleScript.
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
This rule detects the delivery of a macOS Startup Item Property List (.plist) file via HTTP that contains the string "StartupParameters". This could indicate an attempt to establish persistence on a macOS system by creating or modifying a startup item.
This rule detects the creation of an Emond rule on macOS systems, which can be used for persistence. It specifically looks for network traffic containing the string "/etc/emond.d/" in a TCP flow to a server on port 22 (SSH). This indicates an attempt to establish or modify an Emond rule, which allows for scheduled execution of commands or scripts.
Page 147 of 174