Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects execution of binaries or scripts from /dev/shm. Attackers use this in-memory filesystem to evade disk-based forensic scanning.
Identifies the execution of process enumeration commands ('ps aux' or 'tasklist') spawned by Node.js or Bun environments, a technique used by the Miasma worm to detect running EDR agents before executing credential harvesting routines.
Correlates a script connecting to an LLM API and immediately piping the response or executing rapid shell commands (cmd/bash) representing AI-generated reconnaissance or exploit execution.
Detects Python executing OS commands spawned directly from the deserialization of a poisoned Pickle model file. This rule correlates process creation events where 'python.exe' initiates a command interpreter ('cmd.exe', 'sh', 'bash') with file access events to common Pickle file extensions ('.pkl', '.pickle', '.pth', '.bin').
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Oversized Executable Created by Archiver
Cortex XDR
This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.
Detects Node.js or Bun executing specific hidden setup files indicative of the Miasma payload being triggered by IDE configuration files (Cursor, Claude, Gemini, VSCode). This rule looks for process execution where the filename is 'node.exe', 'node', 'bun.exe', 'bun', or common shells ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh', 'zsh') and the command line contains specific Miasma payload patterns like '.github/setup.js', '.claude/setup.mjs', or 'bun run' with '.config/index.js'.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule finds Bun extracted to a temporary folder during npm install on a machine that does not normally use Bun. Temp paths hide binaries from casual inspection. Remove the package and scan the host. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects when AI agent processes establish listening connections on network ports, indicating potential unauthorized service exposure or lateral movement activity.
This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Detects the simultaneous creation of .pkg_history and .pkg_logs in a temporary directory, indicating the setup.cjs dropper associated with the Mastra NPM supply chain attack.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
Page 253 of 340