Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects suspicious execution of Node.js processes initiated by VS Code (or Cursor) that appear to be running JavaScript payloads disguised as font files (.woff2) or other suspicious assets. It also monitors for the creation or modification of '.vscode/tasks.json' files by package managers or source control tools, which could indicate the configuration of malicious 'folderOpen' tasks used for persistence or automated execution upon workspace opening.
Detects anomalous process spawning behavior initiated by AI IDE extensions (e.g., Amazon Q, Claude Code, Cursor) when loading Model Context Protocol (MCP) configuration files. The rule flags instances where these IDE components trigger suspicious child processes or command-line executions, which could be indicative of remote code execution (RCE) via malicious mcp.json workspace configurations.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
Detects the presence of specific file artifacts ('VULNERABILITY_CONFIRMED.marker', 'smtp-crlf-injection.curlrc') associated with the 'curl-smtp-expn-recipient-crlf-injection' proof-of-concept repository. The rule also correlates this with the execution of the associated 'run_demo.py' script from directories containing 'curl-smtp', helping identify active use of this testing framework.
Detects the presence of known malicious Chrome extension IDs, suspicious configuration files (e.g., perplexity-rules.json, bing-rules.json), or extensions utilizing invasive declarativeNetRequest permissions, which are often used for browser-based exfiltration or credential interception.
Detects suspicious subprocesses spawned by IDE or extension host processes (like VS Code or Amazon Q) that execute AWS CLI commands to enumerate identity or immediately exfiltrate data via curl/wget, indicating potential credential abuse by malicious plugins or MCP servers.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects a Node.js process, spawned as a child of an IDE (e.g., VS Code, Cursor), that accesses local AWS configuration or credential files followed by an outbound network connection to a non-AWS destination. This behavior is indicative of potential cloud credential exfiltration via malicious Model Context Protocol (MCP) server execution.
Detects the creation of Model Context Protocol (MCP) server configuration files (such as .mcp.json or those in .vscode/ and .amazonq/ directories) shortly after a Git operation (pull, fetch, merge, or clone). This pattern is indicative of a supply chain attack where a contributor introduces malicious MCP configurations into a workspace, which are subsequently loaded by development tools like VS Code, Cursor, or language servers to execute arbitrary code or exfiltrate data.
This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.
This rule detects potentially malicious activity where 'npm' or 'node' processes spawn sensitive child processes (e.g., cmd.exe, powershell.exe, python.exe, curl.exe) in contexts associated with package installation (e.g., node_modules, postinstall scripts) or known indicators of compromise related to supply chain attacks and credential theft.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Detects the installation of known malicious Chrome extensions, specifically Adblock for YouTube, Adblock for Chrome, Adblock for You, and AdBlock Suite. These extensions have been associated with malware distribution, removal from the Chrome Web Store, or dormant remote code execution capabilities via server-fetched scriptlets.
Detects Node.js being used to establish reverse shell connections
Detects exfiltration of data to Dropbox cloud storage
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects high-volume failed authentication attempts targeting a specific user account from a source IP address, indicative of 'MFA fatigue' or 'push bombing' attacks. This rule monitors endpoint-visible logon failure events as captured by EDR telemetry to identify potential attempts to circumvent multi-factor authentication by spamming the user with requests.
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
Detects endpoint browser and email client processes initiating network connections to domains and IP addresses associated with HolaBrief and LoopedIn open-redirect infrastructure, commonly leveraged in invoice-themed phishing campaigns.
Page 100 of 174