Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
Detects the bun setup.mjs execution acting as a parent, spawning further suspicious processes like curl or bash. This behavior is indicative of potential supply chain compromise where a legitimate-looking setup script executes malicious commands.
This rule detects Node.js processes executing JavaScript files with exactly 24 hexadecimal characters in their filename from temporary directories (temp or tmp). This pattern is associated with the Mastra NPM supply chain compromise.
Detects a remote access utility spawning command shells or script interpreters, indicating hands-on-keyboard activity through an RMM session.
Detects when non-Node.js scripts, specifically Python or Bash/Shell, modify or create a 'package.json' file. This activity can indicate an attempt to silently inject malicious dependencies into clean repositories, a technique observed with malware like Miasma.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
Detects the execution of bash, python, or node scripts originating from the /tmp directory. This is a common staging location for malicious droppers and scripts.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.
Detects instances where 'wget' is used to download content and pipe it directly into a shell interpreter (bash, sh, or zsh). This technique is often used for fileless execution, allowing adversaries to download and execute malicious scripts without writing them to disk.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Identifies execution of the Python credential stealer script named detect_malware.py, associated with the UNK_DeadDrop phishing campaign.
Detects PowerShell accessing browser Local State files to steal credentials. This rule specifically looks for file access events where the file name is 'Local State' and the initiating process is 'powershell.exe' or 'pwsh.exe'.
Detects pythonw.exe or python.exe executing 'udp.pyw' or 'modes.py'. The script 'modes.py' is associated with ModeloRAT.
Detects PowerShell iterating directories for known cryptocurrency wallet extensions and associated strings, indicative of PS1Bot malware activity attempting to harvest wallet data.
Detects PS1Bot generating randomly named .lnk files in the Windows Startup folder using PowerShell.
This detection captures the initial self-infection mechanism of ClickFix campaigns before secondary payloads are downloaded. It identifies PowerShell execution matching the ClickFix clipboard pattern, specifically launching with hidden window styles and executing base64-encoded strings via Invoke-Expression (IEX).
Identifies shell commands associated with downloading architecture-specific payloads (e.g., mips, mipsel) commonly used by IoT/SOHO botnet droppers like the JDY botnet.
This rule detects suspicious command-line activity involving `cmd.exe` or `powershell.exe` executing batch files (`.bat`, `.cmd`) or using the `/c copy` command, specifically when targeting common drive letters (C:, D:, E:) and explicitly excluding commands that contain 'recover', 'restore', or 'decrypt'. This pattern is often observed in ransomware operations attempting to encrypt or manipulate files on local drives.
This rule detects suspicious command-line activity involving `cmd.exe` or `powershell.exe` executing batch files (`.bat`, `.cmd`) or using the `/c copy` command, specifically when targeting common drive letters (C:, D:, E:) and explicitly excluding commands that contain 'recover', 'restore', or 'decrypt'. This pattern is often observed in ransomware operations attempting to encrypt or manipulate files on local drives.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Page 133 of 191