Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Detects the creation of hidden configuration files (e.g., .sv_config.json) in hidden directories, indicating the installation or configuration phase of the SPECTRALVIPER backdoor. The rule specifically looks for files created in a directory matching the pattern `/.config/spectralviper/` or files named `.sv_config.json`.
Detects attempts to stop or disable endpoint security tools, firewalls, or mandatory access control systems (like SELinux/AppArmor) to clear the path for Miasma components. This rule specifically looks for command-line executions using 'systemctl stop' or 'service stop' in conjunction with common security tool names like 'ufw', 'iptables', 'falcon', 'sentinelone', 'apparmor', or 'selinux'.
Detects anomalous connections to Sigstore infrastructure (Fulcio/Rekor) by non-standard processes. This activity could indicate an attempt to forge or manipulate supply chain signatures, potentially by malware like Miasma.
Detects modifications to /etc/ld.so.preload or the dropping of .so files by scripting languages, a technique SPECTRALVIPER uses to hook system calls and hide its activity.
Detects modifications to the VSCode tasks.json configuration file by processes other than the VSCode editor itself. This activity can indicate an attempt to establish persistence or execute malicious code, as seen with malware like Miasma which alters this file to run malicious code during local builds.
Detects memory dumps piped to 'tr -d' to strip null bytes. This specific shell pipeline is a known Miasma technique used to parse raw process memory for readable secrets.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects the use of the Electron setLoginItemSettings API for startup persistence. This API allows Electron-based applications to configure themselves to launch automatically when a user logs in, which can be abused by adversaries to maintain access to a system.
Detects processes making network requests to the '/cf.js' endpoint, which is indicative of ErrTraffic activity. This rule specifically looks for network events where the remote URL ends with '/cf.js'.
Detects the execution handoff from a malicious JavaScript extension within VS Code to host-specific execution agents. This includes compiled Windows executables like 'monitor-agent.exe', 'job-agent.exe', 'processor-service.exe', and Python processes executing Linux/macOS agent scripts such as 'handler-agent.py', 'monitor-agent.py', 'processor-agent.py'. The detection logic filters for processes initiated by 'node.exe', 'electron.exe', or 'code.exe'.
Identifies authentication binaries (sshd, su, sudo) loading a pam_unix.so module that contains anomalous compile-time RPATHs pointing to the attacker's staging directories, as observed in the Velvet Ant campaign.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule looks for the creation of a file named 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' or the execution of 'meshagent' or 'meshcentral' processes from suspicious directories or initiated by common shell/download utilities.
This rule detects commands executed within GitHub Actions build jobs that attempt to read memory from the GitHub Actions runner process. This technique is often used in supply-chain attacks to extract secrets that reside in the runner's memory during job execution. The rule specifically looks for command-line arguments containing '/proc' and 'Runner.Worker' along with keywords like 'mem', 'cmdline', 'grep', 'tr -d', or 'isSecret'.
Detects suspicious child processes spawned by Langflow or n8n workflow services, indicating potential unauthenticated Remote Code Execution (RCE) exploitation. The rule specifically looks for these applications (or their underlying node/python processes) spawning common shell processes (cmd.exe, powershell.exe, bash, etc.) which then execute commands typically associated with RCE payload retrieval or execution (wget, curl, Invoke-WebRequest, base64, iex, Invoke-Expression).
Detects HID keystroke injection attacks from hardware implants
Detects relocation of malware to new paths to evade detection signatures
This rule detects when package managers like npm, bun, or pnpm access SSH private key files. Such activity can indicate a supply chain attack where a malicious package attempts to exfiltrate sensitive credentials, granting unauthorized access to servers. If this alert fires, investigate the initiating process, check for newly installed software, and audit server logins associated with the compromised SSH key. Involve your security team if the cause is unclear.
Page 255 of 340