Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects malicious activity related to the TCC.db, commonly abused by macOS malware to bypass Transparency, Consent, and Control (TCC) restrictions.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
Detects logs cleared in MacOS systems
Detects the creation of a 'startup.js' file in specific, non-standard subdirectories used by the Lazarus Group's 'Graphalgo' campaign to stage malicious payloads. These paths mimic legitimate application folders to evade detection.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
This rule detects the execution of 'osascript' on macOS when its parent command line contains 'curl'. This pattern is indicative of a stager piping a curl response directly to osascript, often without writing a script to disk, as described in the ClickFix and MacSync/SHub delivery patterns by Datadog.
Detects a sequence of macOS system profiling and software update commands associated with the UNC1069 'ClickFix' social engineering ruse, often followed by a payload download via curl piped to a shell.
Detects the use of 'dscl . authonly' to validate user passwords, a technique
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
Detects the execution of processes named 'openclaw-agent.exe' or 'openclaw-agent'. These binaries are being distributed as malicious 'prerequisites' in weaponized OpenClaw AI agent skills to install infostealers and other malware.
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
Detects inbound network connections from external (non-loopback, non-private) IP addresses to ports commonly used by Clawdbot/Moltbot gateways (3000, 8080, 16007). An exposed gateway is a significant security risk that can allow unauthorized remote administrative control over the AI agent.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Page 158 of 174