Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.
Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects a modified Dockerfile or build script installing netcat and building/pushing a multi-arch image via docker buildx, consistent with backdoored container image creation
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Detects presence of known-malicious Jscrambler npm supply chain dropper artifact filenames dist/setup.js and dist/intro.js referenced or embedded within scanned content (package contents, tarballs, manifests)
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detects the creation, modification, or renaming of ZIP archive files prefixed with 'zx_' within the macOS crash reporter cache directory. This behavior may indicate an adversary staging crash report data for potential exfiltration.
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects unauthorized attempts to modify or interact with the macOS Transparency, Consent, and Control (TCC) database. This includes direct file system modifications by non-system processes, sqlite-based manipulation of the TCC database, or the usage of 'tccutil' to reset permissions. These behaviors are often indicative of malware attempting to silently elevate privileges or grant itself Full Disk Access to sensitive user data.
Page 53 of 110