Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects a Node or Bun process writing to Claude Code or VS Code autostart configuration. The
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
Detects the execution of unsigned JavaScript (.js) files using the Windows Script Host (wscript.exe). Adversaries often use JavaScript for initial execution or as a secondary payload, and obfuscation is commonly applied to these scripts to evade detection.
Detects instances where VS Code (Code.exe) or Node.js (node.exe) processes reference CI/CD-related environment variables in their command line. This behavior is often associated with build pipeline manipulation, credential harvesting from environment configurations, or post-exploitation activities within developer environments.
Detects malicious script execution triggered by the CVE-2026-42897 XSS vulnerability in Outlook Web Access (OWA). The detection rule monitors AMSI script detection events for patterns associated with the OWAReaper exploit chain, which utilizes an 'onload=eval(atob())' loader to reconstruct a base64-encoded payload embedded in social-icon image tags within a browser session.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the Miasma loader, associated with supply chain attacks on NPM packages (e.g., ShinyHunters campaign), spawning a hidden, detached Node.js child process during module import. The detection monitors for a Node.js process spawning a child node.exe with the '-e' flag and a specific obfuscated variable prefix used by the malware to execute malicious code while bypassing --ignore-scripts.
Detects the execution of JScript files via wscript.exe where the file name follows the 'wupd_' naming convention. This pattern is characteristic of LabubaRAT, which drops obfuscated or malicious scripts with this prefix to execute them using the Windows Script Host.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects indicators of the Miasma worm compromise on Windows and macOS systems. This includes the execution of malicious Spectral CLI payloads from npm npx cache directories, the staging and execution of sync.js payloads, the creation of Miasma-specific lock files and Cryptnet cache artifacts, and persistence established via Windows Registry Run keys.
Detects the execution of the Stoplight Spectral CLI tool from within the temporary npm/npx cache directory structure on Windows endpoints. This behavior is associated with supply-chain attacks, where malicious packages exploit npx cache paths to execute unauthorized code. The rule accounts for both fixed cache identifiers observed in specific campaigns and generalized paths used by npx, while excluding benign Playwright test executions.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Page 11 of 34