Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Detects network traffic to Cloudflare-hosted services (trycloudflare.com, workers.dev) potentially indicative of C2 communication, especially when initiated by common scripting or proxy processes like powershell.exe, wscript.exe, cscript.exe, mshta.exe, or cloudflared.exe.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
This rule monitors network traffic for DNS queries directed at domains associated with known malicious browser extensions, specifically targeting Adblock for YouTube and Adblock for Chrome malicious variants. It correlates these connections with process command line evidence that matches the extension IDs of these malicious components.
This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Detects execution of macOS.Gaslight malware by identifying specific function calls within process command lines, specifically 'SecTrustSetAnchorCertificatesOnly' for certificate pinning, 'SCDynamicStoreCopyProxies' for proxy awareness, and 'CCRandomGenerateBytes' for cryptographical operations. These behaviors are typical of the implant's efforts to maintain encrypted C2 communication while frustrating network inspection tools.
Detects unauthorized access to Chrome and Firefox browser credential (Login Data, logins.json, key4.db) and cookie database files on macOS by non-browser processes, commonly observed in credential theft campaigns like ClickFix.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Correlates the reading of sensitive local files (id_rsa, .env, config.json) followed by an immediate POST request to an LLM API (specifically api.openai.com), indicating data theft via prompt injection or automated analysis.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Detects DNS queries to known StegoAd command-and-control domains 'liveupdt.com' and 'dealctr.com'. These domains are used by the StegoAd campaign to deliver steganographic payloads and push malicious JavaScript to compromised browser extensions.
Detects the creation of persistence mechanisms, specifically cron jobs or LaunchAgent plist files, initiated by the OpenClaw agent process tree (openclaw, openclaw-runtime, openclaw-agent). This behavior is associated with ClawHub skills attempting to maintain C2 access after the skill itself has been removed.
Identifies unauthorized attempts to leverage ssh-add or access the SSH agent socket to dump or forward local developer identities.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects unauthorized execution of node.exe by the Flowise process, where a case-insensitive environment variable (node_options) is used to bypass Flowise's security block list. This enables attackers to leverage the --require flag to preload malicious JavaScript code. The detection also monitors for the presence of a 'flowise_marker.txt' file as a secondary indicator.
Page 114 of 174