Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule monitors for the creation or modification of files containing the string 'readme_locker' in their filename. This pattern is commonly associated with ransomware strains that leave behind ransom notes, often as part of the data encryption impact phase.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
Clipboard hijacking malware for cryptocurrency address substitution
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.
Detects Electron applications attempting to establish persistence using `setLoginItemSettings` in conjunction with JavaScript code execution (`eval`) or external process execution (`child_process` and `execFile`). This combination is indicative of malicious activity, such as that observed in Clickfix attacks, where an application gains persistence and then executes arbitrary code.
Clipboard hijacking malware for cryptocurrency address substitution
Detects the execution of setup or precheck scripts from specific paths ('/tools/setup' or '/.github/scripts/precheck') when spawned by common development-related shell or Node.js processes. This pattern often identifies anomalous build-time activities or execution of unauthorized configuration scripts in CI/CD or development environments.
This rule detects potentially suspicious process execution behavior on Linux systems. It triggers on the execution of specific files often used as build tools or pre-check scripts ('/tools/setup', '/.github/scripts/precheck') or processes spawned from 'node_modules' directories by common Node.js package managers ('npm', 'node', 'npx') where the spawned executable lacks standard script file extensions (e.g., .js, .sh). This is indicative of potential execution of arbitrary binaries or obfuscated scripts within a development or CI/CD environment.
Detects repeated outbound network connections (HTTPS or HTTP) originating from QEMU emulator processes (qemu-system-x86_64 or qemu-system-i386). This activity is indicative of C2 beaconing or post-exploitation traffic originating from a virtualized guest hidden on a host system.
Detects rapid access to multiple sensitive developer credential files (e.g., AWS, Kubernetes, Docker, SSH keys, npm, Git, and crypto wallets) by a single process within a 5-minute window, a pattern indicative of automated credential harvesting.
Teampcp Shell Recon
YARA-L
Tracks shell reconnaissance parsing /var/log/auth.log for successful logins or executing env | grep AWS_.
Detects processes that masquerade as the legitimate 'systemd-userdbd' system service by spoofing their process name. This behavior is commonly associated with malware, such as the MYRA RAT, which uses prctl to alter its process display name to evade detection.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.
Detects persistence and execution behaviors associated with the MYRA Linux RAT. The rule monitors for the installation of a malicious library (.libcache.so) via shell profile modifications, and subsequent execution attempts where a process masquerades as 'systemd-userdbd' while utilizing 'LD_PRELOAD' and fileless execution techniques (memfd_create/fexecve).
Detects malicious node.js processes spawned from npm lifecycle hooks (e.g., install, postinstall) that exhibit suspicious command-line arguments, environment variables, or connections to known malicious domains associated with supply chain compromise campaigns.
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
Page 221 of 341