Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Identifies the creation of a stage-2 binary named 'payload.bin' within a 'node_modules' directory. This artifact is dropped by the Gen-1 stager used in the vpmdhaj malicious npm campaign, which targets cloud and CI/CD credentials.
Detects the execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets). The rule specifically looks for process creation events involving npm, node, or yarn, and then filters for command lines containing specific malicious package names identified in threat intelligence.
Detects the use of launchctl submit to establish persistence on macOS.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
This rule detects attempts to extract the system's hardware UUID using the `ioreg` command, specifically looking for arguments used by the FlutterShell backdoor to query `IOPlatformExpertDevice` and `IOPlatformUUID`. This activity is indicative of system information discovery, often performed by malware to fingerprint a compromised host.
Detects the execution of 'launchctl submit' with specific job names ('chrome.job' or 'coreaudio.job') that have been observed in JINX-0164 macOS campaigns to establish persistence.
Detects the exploitation primitive of CVE-2026-3102 at the post-injection execution layer. The exploit succeeds when exiftool constructs a /usr/bin/setfile command line containing attacker-injected shell metacharacters (single quotes for command injection, backticks or $() for command substitution, semicolons for command chaining). Detecting setfile invocations spawned by exiftool with these characters in arguments is the smoking-gun signal. Even future variants of this vulnerability class (or related n-day exploits in the same family) would produce this same parent/child + metacharacter pattern.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects the creation of the specific LaunchAgent plist file (com.vfrfeufhtjpwgray.plist) used by the macOS execution chain for persistence in the REF6598 campaign delivering PHANTOMPULSE RAT.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
Detects the Node.js process making external DNS requests to api64.ipify.org, a behavior used by the PhantomRaven payload to discover the host's public IP address.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP). This rule specifically looks for connections to 'pack.nppacks.com', 'hblnew.ecompk.com', or the IP address '54.160.138.70'.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
Identifies the first time a specific local Model Context Protocol (MCP) server configuration is executed on a device within the last 24 hours. This rule uses a 7-day historical baseline to filter out previously seen regular activity. It groups rapid-fire child processes spawned by varying MCP initiator arguments (e.g., claude.exe --strict-mcp-config vs --squirrel-firstrun) into a single, consolidated 5-minute session alert.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
Page 149 of 174