Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,206
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,966
2,465
1,059
1,020
903
Platforms
39,752
7,128
6,517
3,846
3,595
Products / Services
1,324
1,059
969
657
487
MITRE Techniques
2,223
1,317
1,309
872
870
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Detects the bun setup.mjs execution acting as a parent, spawning further suspicious processes like curl or bash. This behavior is indicative of potential supply chain compromise where a legitimate-looking setup script executes malicious commands.
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Detects modification of PAM configuration files allowing authentication bypass
Detects VNC connections used for visual remote desktop lateral movement
Links the execution of the initial setup.mjs payload to network traffic bound for audit.checkmarx.cx. This rule detects the execution of 'setup.mjs' via 'bun' followed by network communication to 'audit.checkmarx.cx' within a 10-minute window, indicating potential supply chain compromise activity.
Detects Java or WebLogic processes spawning command interpreters on an application server, which may indicate successful remote code execution.
Detects when non-Node.js scripts, specifically Python or Bash/Shell, modify or create a 'package.json' file. This activity can indicate an attempt to silently inject malicious dependencies into clean repositories, a technique observed with malware like Miasma.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
Detects outbound network connections to 'git-tanstack.com', a typosquatted domain identified as part of the Miasma npm supply chain attack, indicating potential command and control communication.
Detects the collection of system UUIDs or Machine IDs by non-standard processes. This activity is often associated with malware like Miasma, which uses this data to uniquely fingerprint compromised hosts for its botnet registry.
Detects the execution of bash, python, or node scripts originating from the /tmp directory. This is a common staging location for malicious droppers and scripts.
Detects changes to file permissions (chmod +x) for files located within the /tmp directory. This activity is often observed with malware droppers, such as Miasma, which use this technique to make downloaded payloads executable before launching them.
Detects commands enabling the malicious update-monitor or gh-token-monitor systemd services to start automatically on system boot.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.
Detects the creation of hidden files (starting with a dot) in the `/tmp` directory on Linux systems. This behavior can be indicative of malware like Miasma hiding intermediate exfiltration data or configuration files.
Detects unauthorized access to the .npmrc file by unusual processes. Miasma targets this file to hijack NPM publishing rights and propagate supply chain attacks. The rule specifically looks for file access events on '.npmrc' where the initiating process is not a known legitimate NPM-related tool like 'npm', 'node', 'bun', or 'yarn'.
Page 257 of 340