Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
3
Categories
3
3
Platforms
3
Products / Services
10,660
9,758
6,692
4,418
3,748
MITRE Techniques
3
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.