Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects potential persistence attempts on macOS by monitoring 'launchctl' commands used to bootstrap LaunchAgents or modify configuration files related to Apple's software update mechanisms. It also flags file events involving the 'com.apple.softwareupdate' cache directory, which could indicate an adversary attempting to stage or replace update-related files.
This rule detects the creation or modification of files within the Google Chrome browser extensions directory by processes other than legitimate Chrome-related binaries (chrome.exe, GoogleUpdate.exe). This activity is highly indicative of malicious browser extension sideloading or persistence, where an adversary attempts to install a rogue extension to achieve goals such as credential theft, session hijacking, or command-and-control communication.
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
This rule detects the potential replacement of legitimate cryptocurrency wallet applications (Ledger, Trezor, Exodus) by monitoring for the download of zip archives from suspicious paths containing 'zxc' using curl, followed by the creation or modification of files within known wallet application directories. This activity is indicative of a trojanized application delivery mechanism, often associated with info-stealer campaigns.
Detects the creation and configuration of suspicious LaunchAgent and LaunchDaemon plist files on macOS. It identifies files masquerading as legitimate system components (e.g., com.finder.helper, .mainhelper, .agent) or exhibiting common patterns of persistent agent names (random 10+ character names). It also monitors for the use of 'launchctl load' to activate these suspicious configuration files.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects unauthorized or suspicious file access, modification, or creation events targeting sensitive web browser data files, including login credentials, saved passwords, and browser cookies. These files are prime targets for information-stealing malware attempting to harvest sessions or authentication data.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.
This rule detects the use of the Certutil.exe utility with flags commonly associated with adversary techniques such as downloading files, decoding malicious payloads, or manipulating the Windows Certificate Store.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
Detects instances where a user accesses an Exchange email item and subsequently modifies, moves, or deletes the same item within a short 10-minute window using the same IP address. This behavior can be indicative of automated cleanup, unauthorized tampering, or mailbox manipulation.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects deletion, modification, or renaming of the Chrome 'passkey_enclave_state' file by a process other than Chrome. This file contains sensitive wrapped identity, User Verification (UV) private keys, and security domain secrets. Unauthorized access or deletion of this file is indicative of an attempt to force Chrome to re-onboard the device, which may expose key material during the re-registration flow.
Detects unauthorized modifications to the core npm CLI entry point file (cli.js). Adversaries may modify this file to inject malicious code, achieving persistence or executing unauthorized commands whenever the npm tool is invoked.
Page 49 of 110