Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects instances where the Parallels dispatcher service (prl_disp_service) is invoked to install an appliance using a local 'file:///tmp/' URL instead of a trusted remote catalog source, which may indicate an attempt to load unauthorized or malicious virtual appliance files.
Detects instances where AI-assisted coding tools (Claude, GitHub Copilot, Codex) spawn the git process to perform a specific 'checkout' command followed by a full commit hash. This behavior may indicate an automated or malicious attempt to manipulate repository states, inject code, or perform unauthorized checkout operations via an AI-assisted development workflow.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
Detects ClickFix-style social engineering attacks where users are prompted to copy and execute malicious commands in a shell environment. The rule triggers on process execution of terminal or shell binaries (zsh, sh, cmd.exe, powershell.exe) containing indicators of obfuscated execution or remote code downloading, such as piped shell commands (curl | sh/zsh) or PowerShell encoded command execution.
Detects a suspicious sequence of events where the Parallels Desktop dispatcher service (prl_disp_service) executes a tar command with a compression program flag, followed immediately by the creation or modification of a launch agent (.plist) file in system or user launch directories. This pattern is indicative of exploitation or post-exploitation activity attempting to achieve persistence.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects instances where the Parallels dispatcher service (prl_disp_service) is invoked to install an appliance using a local 'file:///tmp/' URL instead of a trusted remote catalog source, which may indicate an attempt to load unauthorized or malicious virtual appliance files.
Detects instances where the Parallels dispatcher service (prl_disp_service) is invoked to install an appliance using a local 'file:///tmp/' URL instead of a trusted remote catalog source, which may indicate an attempt to load unauthorized or malicious virtual appliance files.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the creation of property list (.plist) files within /Library/LaunchDaemons/ or /Library/LaunchAgents/ directories, which is a common persistence mechanism for macOS malware, including cross-platform ransomware variants like CRPx0. The rule filters out events initiated by the system installer process to reduce noise.
Detects the ProRAM macOS ARM64 Mach-O implant, identified by specific internal codesign strings, download URLs (cloudfront.net/helper), and local file drop paths ($HOME/updated) consistent with the Funnull threat actor's activity.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the execution of an unsigned binary named '.macos' located within a 'Contents/MacOS/' directory structure, which is a common pattern for malicious applications attempting to masquerade or hide their execution profile on macOS.
The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
This rule detects the launch of the Terminal application (Terminal.app) on macOS when initiated by a web browser process such as Safari, Chrome, Firefox, or Microsoft Edge. This behavior is indicative of a potential drive-by download attack or a malicious file execution sequence (e.g., ClickLock stealer) where browser-based interactions lead to the execution of system-level command line interfaces.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the use of 'open' or 'nohup' to execute files located within '/Library/Application Support/' specifically containing 'Extra/preinstall' in the command line. This pattern is often indicative of unauthorized or suspicious execution of installation scripts, potentially used to maintain persistence or execute malicious payloads from non-standard locations on macOS systems.
Page 7 of 26