Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,680
9,759
6,693
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects use of codesign to apply an ad-hoc signature to a hidden binary in /tmp, allowing it to execute on modern macOS without a valid developer certificate, typically performed immediately after quarantine removal as part of a Gatekeeper bypass chain.
Linux Ngrok Free Tunnel Domain Observed
Cortex XDR
Detects network or process telemetry containing the 'ngrok-free.app' domain, which indicates the use of ngrok tunnels to expose local services to the internet, potentially bypassing inbound firewall controls or serving as an unauthorized command-and-control channel.
Detects Cortex-managed endpoints that are currently in a disconnected state and are cross-referenced against an inventory of critical or sensitive assets. This rule highlights potential gaps in security monitoring and visibility for high-value systems.
This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.
Detects Visual Studio Code or Node.js processes checking for common CI/CD environment variables (such as GITHUB_ACTIONS, JENKINS_HOME, or GITPOD_WORKSPACE_ID) or specifically testing for the existence of CI environments via 'process.env.CI'. This behavior is characteristic of malicious extensions attempting to identify if they are running within a sandboxed CI/CD build environment to potentially evade detection or adjust their payload delivery.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
Detects NightLedger Command 36 (screenshot capture) by anchoring the ScreenshotTaken event to the implant's known execution context rather than relying on a blocklist of legitimate tools. NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations (LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
Detects NightLedger's delivery mechanism: the implant is compiled as a malicious SspiCli.dll and co-located with AppVShNotify.exe (a legitimate Microsoft App-V binary). AppVShNotify.exe imports RPCRT4.dll, which delay-loads SspiCli.dll when an authenticated RPC call is made; loading the implant from the working directory rather than System32. Any load of SspiCli.dll by AppVShNotify.exe from outside canonical Windows system paths is a binary-confidence indicator with near-zero false positive rate in production environments.
Device Name Search
Cortex XDR
This rule performs a telemetry data retrieval query for a specific agent hostname. It outputs detailed fields related to network connections and process executions (including command lines, user context, and process image names) from the XDR dataset for auditing or investigative purposes.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
Detects the execution of an 'update.exe' process initiated by 'svchost.exe' where the update executable resides in non-standard, user-writable directories (AppData, Temp, Users Public, or Downloads). This behavior is highly suspicious as svchost.exe should typically only execute binaries from system directories, and the target file is running in a location common for malware staging.
Detects PowerShell downloading and executing payloads from the temporary directory using common malware download cradles. Observed in during CLICKFIX-VIDAR campaign
Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.
Detects a sequence where a host performs process enumeration for EDR/AV security tools (CrowdStrike, Sophos) followed within 5 minutes by the execution of Microsoft Edge with specific flags (--headless=new or --no-startup-window, --load-extension, --disable-sync). This pattern is consistent with the UNC6692 'Edgecution' malware tradecraft used to check for security presence before sideloading a malicious browser extension.
Detects the execution of cmd.exe, powershell.exe, or pwsh.exe launched directly from Windows Explorer (explorer.exe) where the command line contains obfuscated arguments, long encoded strings, or specific indicators associated with common click-based execution attacks.
Detects a process chain where mshta.exe is spawned by and descends from mshta.exe, executing a command line referencing a remote HTTP/HTTPS URL, consistent with CountLoader delivery observed in DOUBLECUP LaaS ClickFix campaigns.
Generic rule content from file: Potential OpenClaw | Clawdbot | Moltbot installation
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
This rule monitors process command line arguments for strings containing 'maliciousdomain.com'. This pattern is indicative of a process interacting with a known malicious domain, commonly associated with phishing campaigns or initial access attempts where malicious links or payloads are invoked via command-line tools.
Page 30 of 100