Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
227 detections
Filters
Last updated
All Time
Detection languages
176
45
4
2
Contributors
93
45
35
20
11
Categories
77
72
31
30
21
Platforms
151
57
28
15
8
Products / Services
10,665
9,758
6,692
4,418
3,749
227
MITRE Techniques
75
72
69
39
38
CVEs
4
4
4
4
4
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
Detects the use of 'rm' or 'unlink' commands to forcefully delete specific files or directories within the '/tmp' directory. The targeted files/directories ('osalogging.zip', '/tmp/sync', '/tmp/macsync_') could indicate cleanup activities after a malicious operation or system compromise, potentially related to macOS systems.
Detects developers cloning a repository (mimicking a coding interview test) and immediately executing an anomalous binary or script hidden within the project structure. This behavior is indicative of the Void Dokkaebi threat actor's tactics.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects attempts to read the memory of browser processes (Chrome, Edge, Firefox, Brave, Opera). This activity can be indicative of credential dumping or other forms of data exfiltration from web browsers.
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
This rule detects the dropping of a 24-character hexadecimal JavaScript payload followed by the creation of a '.pkg_history' or '.pkg_logs' marker file within a one-minute timeframe. This behavior is indicative of the Mastra NPM supply chain compromise.
This rule detects a malicious npm package attempting to read Claude MCP connection settings, which may contain sensitive information like API keys and server details. The theft of MCP configuration could allow attackers to impersonate AI integrations. If this rule triggers, the package should be removed, and any associated API keys should be rotated. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
This rule detects queries made within ServiceNow by accounts classified as 'Guest' or 'Unknown'. This could indicate unauthorized access or unusual activity from unprivileged or unidentifiable accounts attempting to query data within the ServiceNow environment.
This rule detects queries made within ServiceNow by accounts classified as 'Guest' or 'Unknown'. This could indicate unauthorized access or unusual activity from unprivileged or unidentifiable accounts attempting to query data within the ServiceNow environment.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects the use of 'chattr +i' to make files immutable. This technique is used by malware, such as Miasma payloads, to prevent security tools and administrators from deleting malicious artifacts, hindering incident response and forensic analysis.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
Detects the use of the GNU Debugger (gdb) to dump process memory (gcore) to disk, a technique abused by attackers to extract credentials residing in Runner.Worker. The rule specifically looks for process creation events where 'gdb' is in the command line along with process ID flags ('-p' or '--pid') and memory dumping commands ('dump memory' or 'gcore').
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
Page 3 of 11