Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Detects passwords dumps from Keychain
Detects usage of system utilities to discover files and directories
Credentials In Files
Sigma
Detecting attempts to extract passwords with grep and laZagne
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.
Detects enumeration of local system groups
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Detects the enumeration of other remote systems.
Detects usage of system utilities (only grep for now) to discover security software discovery
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.
Detects potential suspicious applet or osascript executing "osacompile".
Detects usage of system utilities to discover system network connections
Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Detects wannacry killswitch domain dns queries
Page 174 of 174