Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the Cursor IDE process spawning shell interpreters or
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
Detects LampoRAT malware based on known file hash execution.
Detects execution of shell scripts from mounted disk images (DMG), a technique
used to bypass Gatekeeper restrictions after macOS Sequoia updates.
used to bypass Gatekeeper restrictions after macOS Sequoia updates.
This rule detects the execution of specific malicious JavaScript files (`install.js` or `version.js`) associated with the StegaBin campaign, launched by the Node.js runtime. The detection focuses on the exact file paths identified in the campaign to minimize false positives, as these files are part of a harmful developer package designed to hide its next moves behind normal-looking setup work. Successful detection indicates the initial stage of a supply chain attack, potentially leading to secret theft, remote control, or further payload downloads.
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
Detects the execution of a Python stager associated with OmniStealer. The stager uses an inline command to decompress and execute the final payload, a common technique for this malware family.
This rule detects potential phishing attempts targeting Docusign users. It identifies emails containing URLs or network connections to specific domains (page-docusign-[a-z0-9]+\.workers\.dev) which are commonly used in phishing campaigns to mimic legitimate Docusign login pages or related services. The use of 'workers.dev' subdomains often indicates malicious infrastructure.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
Detects 'osascript' (AppleScript) executing 'curl' to download a second-stage payload. This updated rule is tuned to detect specific indicators from a known campaign, such as the use of silent/insecure flags, downloads to hidden script files (e.g., .ex.scpt), or connections to known malicious domains.
Detects the renaming of the macOS TCC (Transparency, Consent, and Control) directory. This is a specific evasion technique where malware renames the directory to 'com.appled.tcc' to release file locks on the TCC.db, allowing for the injection of permissions.
This rule detects the execution of specific Node.js scripts associated with the StegaBin package campaign. It looks for 'node.exe' or 'node' processes executing command lines containing 'scripts/test/install.js' or 'vendor/scrypt-js/version.js'. The intent is to identify the initial phase of a malicious package installation chain, which could lead to further compromise.
Detects the "EtherHiding" technique used by the FakeGit campaign. The malware queries a Polygon Mainnet smart contract via a public RPC node to resolve its current C2 server address. This rule looks for network connections to known blockchain RPC providers containing the specific function selectors used by the malware's V1 and V2 contracts.
Detects a high volume of network connections from a browser process to a high port on the local host (127.0.0.1 or ::1). This pattern can indicate a malicious website attempting to brute-force credentials for a local service, such as the OpenClaw AI agent, by abusing the browser's permission to establish WebSocket connections to localhost. The vulnerable service may not rate-limit these local connections, allowing for rapid password guessing.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
This rule detects the execution of a process that attempts to build an executable using 'zig build-exe' and subsequently initiates a process with a command line containing 'https://github.com/nullclaw/nullclaw.git'. This could indicate an adversary building a malicious executable on a host and then attempting to download or interact with a malicious GitHub repository, potentially for further stages of an attack.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Page 155 of 174