Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
This rule detects suspicious modifications or creations of Linux login log files (wtmp, btmp, utmp, lastlog, utmpx, wtmpx) by processes that are not legitimate system processes typically associated with managing these logs. Adversaries may modify or clear these logs to hide their presence on a system or to manipulate login records.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
Detects PowerShell being copied and renamed to 'wt.exe' in the ProgramData directory, initiated by cmd.exe, powershell.exe, or pwsh.exe, and executing a command line containing '-curl'. This behavior has been documented in the Axios npm supply chain attack.
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
Detects scripts modifying Windows registry run keys for establishing persistence
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
Detects the creation of specific log files (`ldapd*.1.gz`, `ldapd*.2.gz`) in the `/var/log/` directory. This behavior is indicative of the UNC3886 threat actor utilizing backdoored SSH clients and daemons to harvest and store XOR-encrypted credentials.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Page 181 of 216