Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects a compiled Python extension writing .py or .pyc files into a temporary or profile directory for later execution. This behavior is often associated with malware that uses Python for its runtime logic, where the compiled Python code (e.g., from Cython) extracts and drops the actual Python scripts for execution.
Detects the execution of 'update.py' from a hidden local share, specifically '.local/share/updater/update.py'. This path is a known persistence mechanism utilized by the Miasma toolkit.
Detects the creation of macOS/Linux LaunchAgent property list files associated with 'gh-token-monitor', indicating potential persistence for the Miasma malware family on macOS environments.
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Detects the creation of hidden configuration files (e.g., .sv_config.json) in hidden directories, indicating the installation or configuration phase of the SPECTRALVIPER backdoor. The rule specifically looks for files created in a directory matching the pattern `/.config/spectralviper/` or files named `.sv_config.json`.
Detects attempts to stop or disable endpoint security tools, firewalls, or mandatory access control systems (like SELinux/AppArmor) to clear the path for Miasma components. This rule specifically looks for command-line executions using 'systemctl stop' or 'service stop' in conjunction with common security tool names like 'ufw', 'iptables', 'falcon', 'sentinelone', 'apparmor', or 'selinux'.
Detects anomalous connections to Sigstore infrastructure (Fulcio/Rekor) by non-standard processes. This activity could indicate an attempt to forge or manipulate supply chain signatures, potentially by malware like Miasma.
Detects modifications to /etc/ld.so.preload or the dropping of .so files by scripting languages, a technique SPECTRALVIPER uses to hook system calls and hide its activity.
Detects modifications to the VSCode tasks.json configuration file by processes other than the VSCode editor itself. This activity can indicate an attempt to establish persistence or execute malicious code, as seen with malware like Miasma which alters this file to run malicious code during local builds.
Detects memory dumps piped to 'tr -d' to strip null bytes. This specific shell pipeline is a known Miasma technique used to parse raw process memory for readable secrets.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
Detects unusual processes querying the AWS ECS metadata endpoint (169.254.170.2) to harvest container-level IAM roles and secrets. This rule specifically looks for network connections to the ECS metadata endpoint from processes commonly used for scripting or data transfer, such as node, bun, curl, and wget.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects the use of the Electron setLoginItemSettings API for startup persistence. This API allows Electron-based applications to configure themselves to launch automatically when a user logs in, which can be abused by adversaries to maintain access to a system.
Detects processes making network requests to the '/cf.js' endpoint, which is indicative of ErrTraffic activity. This rule specifically looks for network events where the remote URL ends with '/cf.js'.
Detects the execution handoff from a malicious JavaScript extension within VS Code to host-specific execution agents. This includes compiled Windows executables like 'monitor-agent.exe', 'job-agent.exe', 'processor-service.exe', and Python processes executing Linux/macOS agent scripts such as 'handler-agent.py', 'monitor-agent.py', 'processor-agent.py'. The detection logic filters for processes initiated by 'node.exe', 'electron.exe', or 'code.exe'.
Identifies authentication binaries (sshd, su, sudo) loading a pam_unix.so module that contains anomalous compile-time RPATHs pointing to the attacker's staging directories, as observed in the Velvet Ant campaign.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule looks for the creation of a file named 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' or the execution of 'meshagent' or 'meshcentral' processes from suspicious directories or initiated by common shell/download utilities.
This rule detects commands executed within GitHub Actions build jobs that attempt to read memory from the GitHub Actions runner process. This technique is often used in supply-chain attacks to extract secrets that reside in the runner's memory during job execution. The rule specifically looks for command-line arguments containing '/proc' and 'Runner.Worker' along with keywords like 'mem', 'cmdline', 'grep', 'tr -d', or 'isSecret'.
Page 262 of 347