Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects potentially malicious modifications to PostgreSQL configuration files or the creation of new library files (.so or .dll) by the PostgreSQL service process. It also flags when the PostgreSQL service process is initiated with command-line arguments referencing 'shared_preload_libraries', which can be abused to load arbitrary code or malicious extensions into the database engine.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects malicious markdown files (SKILL.md) that impersonate agent instruction files. These files contain hidden-content constructs (like CSS display:none, HTML comments, or invisible Unicode characters) combined with common command execution patterns (like curl, wget, or PowerShell encoded commands), characteristic of infostealer campaigns targeting AI agent platforms.
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
Detects instances where processes other than the primary web browsers (Chrome, Brave, Firefox) create, rename, or modify sensitive browser data files like 'Cookies' or 'Login Data'. This behavior is indicative of credential theft or data exfiltration attempts where an adversary is accessing browser-stored information.
The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
Detects execution patterns associated with the Apple macOS Stealer (AMOS) ClickFix malware, specifically the removal of quarantine attributes and permission modification for a staged 'helper' executable within the /tmp directory, followed by the execution of that binary.
Detects macOS persistence mechanism involving the registration of a disguised LaunchAgent via 'launchctl bootstrap', storing payloads in paths masquerading as system cache directories, and the subsequent removal of the 'com.apple.quarantine' extended attribute using 'xattr' to bypass Gatekeeper execution restrictions.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
This rule detects attempts to bypass macOS Gatekeeper security controls by disabling security policies via the 'spctl' command, or by removing file quarantine attributes using the 'xattr' utility. These techniques are commonly used to execute unauthorized or malicious software that would otherwise be blocked by macOS security features.
Detects the creation, modification, or renaming of .plist files within the /Library/LaunchAgents/ directory on macOS. This directory is a common location used by adversaries to establish persistence, as files placed here are automatically loaded and executed by the system upon user login.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
This rule detects installation, file activity, or registry configuration changes associated with the 'bright-save-feed@tabtools.org' browser extension identifier. Such identifiers are commonly associated with malicious browser add-ons or potentially unwanted programs (PUPs) that may be used for browser session hijacking, unauthorized content injection, or persistent access.
This rule detects the use of the 'xattr' utility to remove the 'com.apple.quarantine' extended attribute from files located in '/tmp/'. Removing this attribute is a common technique used by attackers to bypass macOS Gatekeeper security controls, allowing unauthorized or malicious applications to execute without user prompts.
Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
Detects the creation, modification, or renaming of systemd service files within a user's configuration directory (~/.config/systemd/user/). The rule further correlates these file events with the execution of 'systemctl --user' commands to enable or start these services, which is a common pattern for establishing user-level persistence on Linux systems.
Page 47 of 110