Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects outbound HTTPS traffic to known malicious infrastructure (supp0v3[.]com), used across all campaign waves for credential theft and remote access.
Detects the creation or renaming of the 'SmartPrintScreen.exe' file within the specific staging directory '\ProgramData\SmartPrint\' used by the LotusLite dropper. This activity indicates the staging of malicious files prior to execution.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Recent reporting indicates the campaign targeted GitHub repositories by inserting malicious GitHub Actions / CI workflows designed to steal secrets and credentials.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
This rule detects when a single process rapidly creates or modifies three or more YAML files (files ending with '.yaml' or '.yml') within an hour. It specifically looks for these activities in paths containing 'config' or 'pipeline', which could indicate configuration changes, deployment activities, or potential malicious manipulation of system or application settings.
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion, often used by malware to remove its traces.
Detects the execution of Windows processes where the parent process is wsl.exe. This indicates WSL interop functionality being used to execute host-side binaries from within the Linux environment, a technique often used to trigger staged payloads.
Detects connections to 'lhr.life' tunnel domains. Miasma utilizes temporary tunneling services to bypass ingress firewalls and establish reverse shells.
Detects enumeration of git credential helpers via 'git config --global credential.helper'. This command is used by adversaries, such as Miasma, to determine how credentials are stored (e.g., wincred, osxkeychain, store) before attempting extraction.
Detects tampering with 'binding.gyp' files by processes other than 'npm', 'node', or 'yarn'. Modifying these build scripts can allow attackers to achieve arbitrary code execution during the 'npm install' phase, indicating a potential supply chain compromise.
Detects the execution of the LotusLite backdoor by identifying its unique command-line argument '--DaDaBar' in conjunction with known executable names ('SmartPrintScreen.exe') or specific staging directories ('\ProgramData\SmartPrint\'). This rule targets a specific execution pattern of the LotusLite malware.
Page 410 of 509