Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
8
Contributors
8
Categories
3
3
3
2
2
Platforms
6
4
2
2
1
Products / Services
3
2
1
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
Detects the use of 'curl' to download content that is then directly piped to a shell interpreter (bash, sh, zsh). This technique is often used for fileless execution, where a malicious script is executed without being written to disk, as noted in the context of initial Miasma stages.
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Detects suspicious commits pretending to be the Claude AI bot but pushing dependency updates, a tactic Miasma uses to blend in with legitimate automated pull requests.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects the creation of hidden files (starting with a dot) in the `/tmp` directory on Linux systems. This behavior can be indicative of malware like Miasma hiding intermediate exfiltration data or configuration files.
Detects outbound network connections to 'api.masscan.cloud', a known Miasma Command and Control (C2) domain. This rule identifies potential compromise by the Miasma malware family attempting to communicate with its C2 infrastructure.