Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the presence of specific compromised versions of popular NPM packages. These versions were tampered with to include a malicious crypto wallet drainer as part of a supply chain attack.
Detects the creation of a .plist file in macOS LaunchAgents or LaunchDaemons directories, a technique used by SHAMOS malware for persistence. This rule looks for the specific SHAMOS plist file or for any plist created by a process running from a suspicious location.
Detects modification of common macOS shell configuration files, a technique used by the ChillyHell backdoor for persistence.
Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Detects attempts to list or dump macOS Keychain data using the built-in 'security' utility. This activity can be indicative of credential theft attempts by an adversary.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
Detects the execution of osascript with a command line that includes curl to download and execute a remote script, a technique used by the Odyssey Stealer malware.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Detects the execution of 'dscl . authonly' by a script interpreter, a technique used by Odyssey Stealer to validate user passwords obtained from a malicious dialog prompt.
Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.
Detects the execution of an application from a mounted disk image (DMG) with a name known to be used by Odyssey Infostealer. This activity is indicative of initial access, where the user has been tricked into running a malicious application masquerading as a legitimate software installer or updater.
Detects the creation of a randomly named LaunchDaemon .plist file in /Library/LaunchDaemons/, a technique used by Odyssey Stealer for persistence.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
Detects a file being created in a temporary macOS directory, made executable, and then executed by a shell. This behavior is consistent with the Odyssey Infostealer, which downloads and runs scripts from temporary locations.
Detects the execution of an AppleScript, characteristic of the Odyssey Stealer, that displays a dialog box prompting the user for their password.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
High confidence that the same actor is responsible for earlier attacks attributed to BlueNoroff and the RustDoor/ThiefBucket and RustBucket campaigns. SentinelLABS observed the use of a novel persistence mechanism abusing the Zsh configuration file zshenv.
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
Page 165 of 174