Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,641 detections
Filters
Last updated
All Time
Detection languages
1,765
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,951
7,276
6,526
3,865
3,641
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects the creation, writing, or renaming of specific files associated with the compromised Axios npm package versions 1.14.1 and 0.30.4. Upon installation, the postinstall script of these compromised packages deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. The rule specifically looks for file paths indicative of these dropper activities across different operating systems.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects the use of the macOS native ditto command to compress files and directories into a .zip archive. This technique is frequently used by macOS stealers, such as Miolab and AMOS, to quietly stage collected sensitive documents (PDFs, TXTs, RTFs) and profile data before exfiltrating it to a remote command-and-control server, avoiding the need to drop noisy third-party archiving tools.
Detects the execution of the native macOS dscl utility with the -authonly flag. This technique is used by malware, such as Miolab Stealer, to silently validate phished user credentials captured via fake authentication prompts before escalating privileges or exfiltrating data.
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
This rule detects the first stage of activity once a compromised endpoint runs the affected Axios package (versions 1.14.1 and 0.30.4). It specifically looks for process creation events where the command line contains a call out to the C2 domain 'sfrclak.com'. This indicates the dropper scripts attempting to establish communication with their command and control server.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.
Requires Defender DeviceNetworkEvents table
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
Detects the installation or execution of compromised npm packages related to the Axios supply chain attack, with execution or reference to the dropped macOS RAT payload.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
This rule detects the forced removal of legitimate cryptocurrency wallet applications (Ledger Wallet, Trezor Suite, Exodus) followed by the extraction of new applications into the /Applications directory on macOS. It also looks for chmod commands to make the new applications executable and attempts to download suspicious zip files from 'wusetail.com'. This activity is indicative of the AMOS malware campaign, which aims to replace legitimate wallet applications with trojanized versions to steal cryptocurrency.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
Page 153 of 174