Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects outbound network connections to the domain 'trackpipe.dev', which is associated with the GhostClaw/GhostLoader macOS malware. It specifically looks for UUID-like identifiers in the URL path, indicating per-repository communication patterns used by the malware.
This rule detects the presence of specific 'NODE_CHANNEL' values ('anglmf', 'cryptoexth4', 'complexarchaeologist1') in process command lines or network event initiating process command lines on macOS systems. These values have been observed in the GhostClaw/GhostLoader malware campaign, indicating potential execution or network communication related to this threat.
This rule detects an AMOS-style macOS AppleScript loader. It identifies a combination of execution chain strings. The rule requires a specific number of these elements to be present, along with a magic byte check or the string 'osascript -e'.
Detects codesign --sign - used to ad-hoc sign a payload dropped to /private/tmp by a non-system process
Detects the macOS RAT com.apple.act.mond beaconing via HTTP POST with spoofed IE8 User-Agent which was spread via axios supply-chain attack
This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.
Detects the execution of `system_profiler` querying memory and hardware data types. Atomic Stealer (AMOS) utilizes these environmental awareness checks prior to execution to evade analysis by determining if it is running within a virtual machine environment.
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects instances of the openssl command-line tool being used to encrypt data with AES-256-CBC and RSA OAEP padding. This specific sequence matches the credential encryption pattern observed in the Linux/macOS payload of the malicious telnyx PyPI package attributed to TeamPCP.
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Detects DNS queries to Solana RPC endpoints associated with GlassWorm/ForceMemo blockchain-based C2. The malware queries up to 9 Solana RPC endpoints to retrieve C2 instructions from on-chain transaction memos. A Python process resolving any of these domains is anomalous outside of cryptocurrency development environments.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects Cursor IDE spawning download utilities or LOLBins commonly used for
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
Page 154 of 174