Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
The analytic detects AMOS Stealer VM check activity on macOS. It identifies the execution of the "osascript" command along with specific commandline strings that include "set", "system_profiler", and either "VMware" or "QEMU". This activity is indicative of AMOS stealer attempting to determine if it is running within a virtual machine environment. If confirmed malicious, this behavior suggests the host is infected by the AMOS stealer, which could lead to arbitrary code execution, privilege escalation, information theft, or persistence, posing a significant security risk.
The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
Detects HTML phishing pages created by the 'IUAM ClickFix Generator'. These pages mimic browser verification challenges to trick users into executing malicious PowerShell or Bash commands to deliver infostealers like DeerStealer and Odyssey.
Tracks network events involving connections to specific Visual Studio Tunnel API URLs, which are used for remote development scenarios (like Visual Studio Code's Live Share or remote tunneling features).
This rule detects attempts to browse or access a predefined list of potentially malicious software packages. It monitors proxy logs for occurrences of these package names within the 'file.name' field. Further investigation of network traffic volume (bytes in/out) is recommended to ascertain if a download of the malicious package has taken place.
This rule detects the use of 'launchctl load -w' commands on macOS systems, which is a common method for establishing persistence by loading Launch Agents or Daemons. It specifically looks for process creation events where 'launchctl' is involved with the 'load -w' parameters, while excluding known legitimate processes from Palo Alto Networks, Apple, Zscaler, Adobe, Citrix, Microsoft, Netskope, Red Giant, and Logitech to reduce false positives.
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Detects the execution of NetCat (nc) on macOS systems. NetCat is a versatile networking utility that can be used for various purposes, including port scanning, banner grabbing, file transfers, and creating backdoors. This rule specifically looks for process creation events where the process name is 'nc' and excludes known legitimate uses by 'Jamf Connect' and 'TruU Authenticator', as well as a specific health check script.
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.
Detects the execution of various infostealers and RATs, such as BeaverTail, OtterCookie, WeaselStore, and AkdoorTea, used by the North Korea-aligned threat actor DeceptiveDevelopment.
Detects modification of shell profile files (.zshrc, .bash_profile, .profile) by processes named 'applet' or 'qtop'. This is a fallback persistence mechanism used by the ChillyHell malware.
Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.
Malicious NPM Package Version Download
Cortex XDR
This rule detects the download or installation of known malicious NPM package versions by monitoring process command-line arguments for specific package names and versions. It targets common package managers like npm, yarn, and pnpm, as well as node.exe, to identify instances where a compromised or intentionally malicious package is being introduced into a development or production environment.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
Detects fake image files (BMP, GIF, JPEG, PNG, TIFF) used by the BeardShell backdoor for command and control communications. These files contain an encrypted payload and a size field that matches the file's total size, a technique used by APT28 in the Phantom Net Voxel campaign.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
Detects indicators associated with a supply chain attack compromising popular NPM packages like 'chalk' and 'debug'. The rule identifies network connections to known malicious domains and command-line activity related to the installation of compromised packages.
Page 164 of 174