Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of hidden shell scripts (.sh or .command) located within a mounted disk image (.dmg). This pattern is commonly used by macOS infostealers which masquerade as legitimate applications (such as Notion, Arc, or Raycast) to trick users into executing malicious code after mounting the deceptive installer.
Detects the execution of sensitive command-line tools or environment variables (e.g., AWS CLI, MCP tools, environment secrets) triggered by AI-based development assistants such as Claude, Cursor, or Windsurf. This behavior may indicate an attacker abusing the permissions or capabilities of an AI coding assistant to perform unauthorized cloud discovery or credential access.
This rule detects potentially malicious child processes spawned by Amazon Q or AWS Language Server components (e.g., amazon-q, aws-lsp-server). The rule specifically flags behavior associated with the loading of MCP server configurations, potential unauthorized access to AWS credentials, or network data exfiltration attempts through commonly abused binaries like shell interpreters, python, or curl/wget when these are not signed by Amazon.
Detects the presence or activity of a known malicious Chromium-based browser extension (Perplexity AI imposter, ID: flkebkiofojicogddingbdmcmkpbplcd) through monitoring file system changes in browser directories, registry modifications, or network communication with identified command-and-control infrastructure.
Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.
Detects the execution of AWS CLI commands by common scripting interpreters (Node.js or Python). This behavior is often indicative of automated cloud environment reconnaissance or credential testing using compromised access keys or instances.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
This rule detects network connections to Discord's API webhooks endpoint, specifically looking for POST requests. This activity can indicate data exfiltration, command and control communications, or other malicious use of Discord webhooks by adversaries.
Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects processes attempting to read or open sensitive SSH files (keys and configuration) that are not recognized as legitimate SSH-related utilities (e.g., ssh, sshd, rsync, git). This behavior is often indicative of credential harvesting or unauthorized reconnaissance of authentication artifacts.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Detects instances where development IDEs (VS Code or Cursor) spawn suspicious child processes such as command shells (cmd, powershell, bash) or network utilities (curl, wget). The detection logic focuses on common command line patterns associated with IDE tasks or potential malicious activity.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects instances where scripting processes (Python, Node.js) accessed SSH key files or configuration files and subsequently initiated an outbound network connection within 60 seconds, which may indicate potential exfiltration of credentials or unauthorized access.
Detects suspicious executions of Python interpreters or Pip package managers originating from common development tools (like VS Code or Node.js) or utilizing temporary file paths. The rule also monitors for suspicious command-line arguments that indicate obfuscation, encoded payloads, or the use of dynamic evaluation functions.
Detects the creation or modification of suspicious Launch Agent or Launch Daemon .plist files, or a hidden application support directory, masquerading as 'com.apple.accountsd' on macOS. This behavior is often indicative of persistence mechanisms used by adversaries.
Detects modification of shell profile files for command execution on login
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Page 113 of 174