Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
This rule identifies devices that have software installed which has reached its End-Of-Support (EOS) status. This is crucial for identifying potential security vulnerabilities due to unpatched software and for maintaining compliance with organizational security policies. The rule summarizes the count of such software instances per device, along with the software name and its End-Of-Support date.
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
Detects the creation or modification of an unsigned Spotlight importer (.mdimporter) bundle within a user's Library/Spotlight directory on macOS. This activity is indicative of the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker leverages a malicious, unsigned importer to gain unauthorized access to TCC-protected data via the mds/mdworker processes.
Detects the creation of a Spotlight importer bundle (.mdimporter) in a user's Library directory. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker places a malicious importer to be executed with elevated privileges by the mds_stores process, allowing unauthorized access to TCC-protected data.
A USB device with Vendor ID 0E90 is associated with vendor WiebeTech (a.k.a "CRU"), which is known to manufacture "mouse jigglers." These hardware devices can be used to prevent a computer from automatically locking the screen or going to sleep. Illegitimate use can range from policy violation to nefarious activity like remote desktop abuse.
The following EQL query can be used to hunt for XMRIG executions within your environment.
Description: Detects the execution of a signed macOS application that subsequently spawns a script interpreter like osascript, sh, or bash. This behavior is uncommon for many legitimate GUI applications but is a known TTP for macOS malware like Odyssey Stealer, which uses signed droppers to execute malicious scripts for credential theft, persistence, and payload delivery.
Detects the installation of specific malicious npm packages associated with the North Korean "Contagious Interview" campaign. These packages are known to deliver the XORIndex malware loader.
Detects the creation of hidden configuration files or a LaunchDaemon plist file used by the Odyssey Stealer malware to establish persistence on a compromised macOS system.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Detects the persistence mechanism and command and control (C2) communication used by the Atomic macOS Stealer (AMOS) backdoor. This includes the creation of a LaunchDaemon, download of a helper binary, and C2 task polling.
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
Detects macOS launchd entries that are not part of the standard Apple system, which could indicate persistence mechanisms used by malware; it is an invalid rule due to a future date.
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query from file: CVE-2024-7971 Patch Prioritization
Page 166 of 174