Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.
Detects the execution of various infostealers and RATs, such as BeaverTail, OtterCookie, WeaselStore, and AkdoorTea, used by the North Korea-aligned threat actor DeceptiveDevelopment.
Detects modification of shell profile files (.zshrc, .bash_profile, .profile) by processes named 'applet' or 'qtop'. This is a fallback persistence mechanism used by the ChillyHell malware.
Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.
Malicious NPM Package Version Download
Cortex XDR
This rule detects the download or installation of known malicious NPM package versions by monitoring process command-line arguments for specific package names and versions. It targets common package managers like npm, yarn, and pnpm, as well as node.exe, to identify instances where a compromised or intentionally malicious package is being introduced into a development or production environment.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
Detects fake image files (BMP, GIF, JPEG, PNG, TIFF) used by the BeardShell backdoor for command and control communications. These files contain an encrypted payload and a size field that matches the file's total size, a technique used by APT28 in the Phantom Net Voxel campaign.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
Detects indicators associated with a supply chain attack compromising popular NPM packages like 'chalk' and 'debug'. The rule identifies network connections to known malicious domains and command-line activity related to the installation of compromised packages.
Detects the presence of specific compromised versions of popular NPM packages. These versions were tampered with to include a malicious crypto wallet drainer as part of a supply chain attack.
Detects the creation of a .plist file in macOS LaunchAgents or LaunchDaemons directories, a technique used by SHAMOS malware for persistence. This rule looks for the specific SHAMOS plist file or for any plist created by a process running from a suspicious location.
Detects modification of common macOS shell configuration files, a technique used by the ChillyHell backdoor for persistence.
Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Detects attempts to list or dump macOS Keychain data using the built-in 'security' utility. This activity can be indicative of credential theft attempts by an adversary.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
Detects the execution of osascript with a command line that includes curl to download and execute a remote script, a technique used by the Odyssey Stealer malware.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Detects the execution of 'dscl . authonly' by a script interpreter, a technique used by Odyssey Stealer to validate user passwords obtained from a malicious dialog prompt.
Page 164 of 174