Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the ransom note file 'How To Restore Your Files.txt' created by the RansomHouse 'Mario' encryptor.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
Detects the installation of specific NPM packages that have been identified as compromised by the Shai-Hulud "Second Coming" worm. Installation of these packages can lead to credential theft and further propagation of the malware.
Extremely basic & rough KQL for the purpose of finding if these extension id's are in any folders across your estate.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects screenshot files being created in temp directories by Node.js processes. OtterCookie captures multi-monitor screenshots and stores them as JPEG files before exfiltration.
Detects the creation of files associated with NPM packages compromised in the "Sha1-Hulud: The Second Coming" campaign. This is a broad query intended for hunting and requires manual verification of package versions.
Detects process execution patterns associated with the "Sha1-Hulud: The Second Coming" NPM supply chain attack. This includes the silent installation of the 'bun' runtime during an 'npm install' and a destructive file shredding command. The rule filters out legitimate manual installations by developers by checking the initiating parent process.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl downloading a file, making it executable with chmod, and executing it in the background, common in FlexibleFerret malware delivery on macOS systems.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Detects creation of FlexibleFerret persistence mechanism via LaunchAgent plist in macOS.
Page 160 of 174