Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects extraction of FlexibleFerret malware payload archive to the CDrivers directory on macOS systems.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Detects execution of ad-hoc signed applications from suspicious locations, used by FlexibleFerret credential harvesting.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Detects command line creation or loading of suspicious LaunchAgent plists related to FlexibleFerret malware on macOS.
Detects execution of MediaPatcher.app decoy application used for credential harvesting.
Detects attempts to use system dialog prompts to capture user credentials
Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.
RMM Tool Hunting
This rule detects the creation or modification of files within specific macOS directories associated with LoginWindow hooks and Authorization Plugins. These locations are commonly abused by adversaries to establish persistence or elevate privileges by injecting malicious code that executes during the login process. The rule specifically looks for file events in '/Library/Security/SecurityAgentPlugins/', '/System/Library/CoreServices/SecurityAgentPlugins/', '/Library/Security/SecurityAgentPlugins.bundle', or any file activity within a 'loginwindow' path. It excludes activities initiated by legitimate installers and software updaters to reduce false positives. Additionally, it filters for files with low global prevalence, indicating potentially suspicious or custom binaries.
Detects the collection and staging of sensitive user data, such as credentials from keychains, browser profiles, and cryptocurrency wallets, by compressing them into an archive. This behavior is a key component of the DigitStealer infostealer's data theft process.
Detects the in-memory execution of AppleScript or JXA payloads via osascript, a technique used by the DigitStealer malware to download and run malicious code while evading file-based detections.
Detects the execution of specific system commands used by the DigitStealer malware for anti-analysis and evasion. This includes checks for virtualization, hardware features (specifically on Apple Silicon), and system locale.
Detects the creation of a Launch Agent .plist file used by the DigitStealer malware. This Launch Agent dynamically retrieves its payload from a DNS TXT record, a technique used for resilient persistence.
Mimikatz payload has been executed on a system as one-liner likely to output to a file for collection
Detects the creation of malicious disk images (.dmg) or a dropper file (.msi) associated with the DigitStealer macOS infostealer campaign.
Detects the execution of `sysctl` commands querying for specific Apple Silicon M2+ hardware features. This behavior is used by the DigitStealer malware for anti-analysis purposes to evade detection and target specific hardware.
Detects the macOS Script Editor (`Script Editor.app`) launching child processes or initiating network connections. This behavior can indicate the execution of a malicious AppleScript used to download secondary payloads or execute arbitrary commands, as seen in campaigns delivering stealers like MacSync and Odyssey.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
Detects possible malicious execution of JXA in-memory via OSAScript
Page 161 of 174