Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Detects the persistence mechanism and command and control (C2) communication used by the Atomic macOS Stealer (AMOS) backdoor. This includes the creation of a LaunchDaemon, download of a helper binary, and C2 task polling.
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
Detects macOS launchd entries that are not part of the standard Apple system, which could indicate persistence mechanisms used by malware; it is an invalid rule due to a future date.
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Discord Invite Hijacking Detection
KQL Query from file: Detect CVE-2025-27607 (CVSS 8.8)
Detects the execution of the "chflags" utility with the "hidden" flag on macOS. When this flag is set on a file or directory, it becomes invisible to default file listing commands and graphical file browsers, a common technique used by adversaries for defense evasion.
Detects the execution of the `hdiutil` utility on macOS to mount disk images. This activity can be associated with malware delivery, as adversaries often use disk images (.dmg files) to distribute malicious payloads. Monitoring this utility can help identify suspicious attempts to introduce or execute malware on a system.
Detects the execution of the hdiutil utility with the 'create' argument, indicating the creation of a disk image on macOS. This activity can be associated with data staging or exfiltration techniques.
Detects potential execution of MeshAgent, a remote access tool, on macOS systems. The rule specifically looks for the '--meshServiceName' argument in the command line, which is indicative of MeshAgent usage. Threat actors often rename the MeshAgent binary to evade detection, making command-line arguments a more reliable indicator.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. This rule specifically looks for process creation events on macOS where the command line contains '--meshServiceName' or the original filename contains 'meshagent', but the image path does not end with the legitimate '/meshagent' or '/meshagent_osx64' paths. This behavior is indicative of an adversary attempting to bypass detection by masquerading the RMM tool.
Process executed from binary hidden in Base64 encoded file. Encoding malicious software is a.
Technique to obfuscate files from detection.
The first and second ProcessCommandLine component is looking for Python decoding base64.
The third ProcesssCommandLine component is looking for the Bash/sh commandline base64 decoding tool.
The fourth one is looking for Ruby decoding base64.
Technique to obfuscate files from detection.
The first and second ProcessCommandLine component is looking for Python decoding base64.
The third ProcesssCommandLine component is looking for the Bash/sh commandline base64 decoding tool.
The fourth one is looking for Ruby decoding base64.
Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.
Detects the execution of the hdiutil utility in order to create a disk image.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can help locate a reverse shell established by an attacker. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can help locate a reverse shell established by an attacker. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
Page 166 of 174