Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects unauthorized or suspicious access to SSH private key files (id_rsa, id_rsa.pub) located in .ssh directories by common scripting or application processes (python.exe, node.exe, Code.exe). This behavior is indicative of credential theft, where an adversary attempts to extract SSH keys to facilitate lateral movement or persistence.
Detects instances where a Java process (typically a web application server like Tomcat) initiates suspicious command-line tools such as cmd.exe, powershell.exe, or various Linux shell binaries, using command-line arguments indicative of a reverse shell or code execution (e.g., -e /bin/sh, -i, /dev/tcp, IEX, DownloadString). This pattern is commonly associated with exploit attempts targeting vulnerabilities like Java deserialization.
Detects ClientKing's technique of loading Linux kernel modules directly from memory (via memfd/init_module) without a corresponding on-disk .ko file, used to deploy rootkit functionality.
Detects a Node or Bun process reaching the cloud instance metadata service. The keyv/cacheable
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
This rule analyzes recent agent telemetry to identify and summarize the distribution of local agent vendors present in the environment over a 30-day lookback period. It extracts vendor information from agent metadata and provides a frequency count to assist in auditing deployed infrastructure agents.
Detects process activity referencing GitHub Actions, GitLab CI, or Azure DevOps pipeline environment variable names (GITHUB_*, CI_*, GITHUB_ACTIONS, GITLAB_CI, Azure DevOps pipeline variables) consistent with a malicious extension harvesting CI/CD runner environment variables.
Detects outbound network connections and DNS queries to a maintained list of known UNC6671 extortion-related domain names. The rule utilizes a temporal 'recency' window (aged IOCs) to filter out stale indicators, mitigating false positives caused by sinkholed or reassigned infrastructure.
Detects a Node or Bun process reading Kubernetes service account tokens or HashiCorp Vault
token files. The keyv/cacheable collector reads these paths directly as part of its credential
sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).
token files. The keyv/cacheable collector reads these paths directly as part of its credential
sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).
Detects creation of the stage-2 payload files distributed with the compromised keyv and
cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written
to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded
Bun runtime. These filenames are specific to the campaign and should be treated as high
fidelity indicators.
cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written
to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded
Bun runtime. These filenames are specific to the campaign and should be treated as high
fidelity indicators.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects execution of a Bun binary from a temporary, download-staging or node_modules path
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
This rule detects potentially malicious activity associated with known supply chain compromise indicators in npm packages (such as Keyv and associated malicious scripts). It flags the execution of specific suspicious files (e.g., 'setup.mjs', 'Math_Symbol.js') or the use of specific versions of common packages known to be associated with recent supply chain attacks, when executed via npm or node.js runtime.
Device Name Search
Cortex XDR
This rule performs a telemetry data retrieval query for a specific agent hostname. It outputs detailed fields related to network connections and process executions (including command lines, user context, and process image names) from the XDR dataset for auditing or investigative purposes.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
Page 148 of 347