Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.
Detects self-deletion commands (e.g., rm -f $0) used by Miasma payloads to remove their execution tracks from disk immediately after running. The rule specifically looks for process command lines containing 'rm', '-f', and either '$0' or '%~dp0', which are common patterns for self-deletion in shell scripts.
Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.
Detects `grep` commands searching for the exact JSON structure (`"isSecret": true`) used by GitHub Actions to store masked secrets in memory. This activity could indicate an adversary attempting to discover sensitive information.
Detects execution of binaries or scripts from /dev/shm. Attackers use this in-memory filesystem to evade disk-based forensic scanning.
Identifies the execution of process enumeration commands ('ps aux' or 'tasklist') spawned by Node.js or Bun environments, a technique used by the Miasma worm to detect running EDR agents before executing credential harvesting routines.
Correlates a script connecting to an LLM API and immediately piping the response or executing rapid shell commands (cmd/bash) representing AI-generated reconnaissance or exploit execution.
Detects Python executing OS commands spawned directly from the deserialization of a poisoned Pickle model file. This rule correlates process creation events where 'python.exe' initiates a command interpreter ('cmd.exe', 'sh', 'bash') with file access events to common Pickle file extensions ('.pkl', '.pickle', '.pth', '.bin').
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Oversized Executable Created by Archiver
Cortex XDR
This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.
Detects creation of disposable email accounts used for attack infrastructure
Detects Node.js or Bun executing specific hidden setup files indicative of the Miasma payload being triggered by IDE configuration files (Cursor, Claude, Gemini, VSCode). This rule looks for process execution where the filename is 'node.exe', 'node', 'bun.exe', 'bun', or common shells ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh', 'zsh') and the command line contains specific Miasma payload patterns like '.github/setup.js', '.claude/setup.mjs', or 'bun run' with '.config/index.js'.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects if the backdoor file 'install-persistent.php' is scheduled for persistence via cron or Windows scheduled tasks. This indicates a potential supply chain compromise targeting ShapedPlugin.
Page 260 of 347