Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects the malicious Open VSX "recon" extension variant checking whether its own extension ID is referenced in the workspace devcontainer.json or .vscode/extensions.json to determine if the install was configuration-driven versus human-initiated
Detects HTTP network traffic containing the endpoint's local hostname transmitted within 30 seconds of a process starting, consistent with 'evil twin' Open VSX extensions that harvest developer environment metadata immediately upon activation.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Detects a code editor process (VS Code, VS Code Insiders, code-server) opening or reading the .git/config or .git/HEAD file, which may indicate a malicious editor extension harvesting private repository and CI/CD configuration data, as seen in the Open VSX "evil twin" extension campaign.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects a process accessing .git/config or .git/HEAD files followed by a network connection or HTTP request from the same agent within a short time window, consistent with the Open VSX 'evil twin' extension campaign harvesting private repository and CI metadata and exfiltrating it to attacker-controlled infrastructure.
Detects VS Code / Node.js processes associated with editor extensions making outbound HTTP requests that contain CI/CD environment variable names (e.g. GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, CIRCLECI, BUILDKITE, CODESPACES, GITPOD), consistent with the Open VSX 'evil twin' extension campaign that harvested private repository and CI/CD data from developer environments.
Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.
Detects installation of malicious "evil twin" Open VSX extensions impersonating AMD, Azure, or Salesforce that carry the tell-tale version 0.0.1 or 0.0.2, identified via file creation/write events in VS Code / Open VSX extension directories.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects a code editor process (VS Code, Cursor, Windsurf, VSCodium) reading the MachineGuid registry value followed within 3-8 seconds by an outbound network connection to a non-private IP from the same process on the same host, consistent with Open VSX evil-twin extensions harvesting developer machine identifiers and exfiltrating fingerprinting data.
Page 32 of 60