Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects network connections or DNS queries to known public tunneling services (e.g., Cloudflare Tunnel, localtunnel, bore, devtunnels) made by processes other than common web browsers. Attackers frequently use these services to bypass firewalls and establish unauthorized reverse shells or persistent C2 channels.
Correlates a user passing a CAPTCHA gate (Cloudflare Turnstile, reCAPTCHA) with an immediate subsequent connection to an unknown, low-prevalence domain hosting the actual phishing landing page.
Identifies the macOS stealer utilizing osascript to pop a fake system dialog, requesting the user's administrator password for privilege escalation.
Detects unauthorized modification or dropping of model files directly into the local Hugging Face cache directory (~/.cache/huggingface/hub) by non-standard development processes, indicating an attempt to swap legitimate models for backdoored ones.
Detects network connections to the Telegram API, specifically to the /sendMessage or /getUpdates endpoints. This activity can be indicative of command and control (C2) communication or data exfiltration using Telegram as a covert channel.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
This rule checks if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a GitHub repository and then uses KQL's `ipv4_is_in_any_range` and `ipv6_is_in_any_range` functions to determine if the provided IP address is part of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
Detects the execution of 'osascript' with command-line arguments indicative of a credential phishing attempt, specifically looking for prompts that display a dialog asking for a password with a hidden answer field. This is associated with the Sapphire Sleet threat actor's macOS intrusion techniques.
This rule detects network connections on port 443 made to common public DNS resolvers (1.1.1.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112) by processes other than known web browsers. This behavior is atypical for standard endpoint processes and may indicate the use of DNS-over-HTTPS (DoH) for command and control or data exfiltration to bypass network filtering.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
This rule detects the use of the JSON-RPC 'eth_call' method by non-browser processes during network connection events. It specifically looks for network connections where the initiating process is not a common web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the 'eth_call' method. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
This rule detects the creation or modification of specific Launch Agent or Launch Daemon plist files on macOS, particularly those masquerading as 'com.apple.accountsd'. It also identifies the creation of a hidden directory '.com.apple.accountsd' within '/Library/Application Support'. This activity is highly suspicious as it indicates an attempt to establish persistence or execute malicious code by mimicking legitimate system services.
Detects DNS lookups and network connections to known AI API endpoints (OpenAI, Anthropic, Google Generative Language) initiated by non-standard processes. This rule excludes common web browsers, productivity applications, and development tools to identify potentially unauthorized or suspicious interaction with AI services from internal processes.
Detects unauthorized access or modification to common CI/CD credential files (.npmrc, .pypirc, .git-credentials, jenkins credentials.xml) and CI/CD configuration files (.github/workflows, .gitlab-ci.yml). The rule monitors both file system activities by non-standard processes and the execution of command-line tools that reference these sensitive files.
Detects DNS lookups and network connections to known AI API endpoints (OpenAI, Anthropic, Google Generative Language) initiated by non-standard processes. This rule excludes common web browsers, productivity applications, and development tools to identify potentially unauthorized or suspicious interaction with AI services from internal processes.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware like SessionGate, Remus, or AnimateClipper attempting dynamic command or address resolution related to blockchain interactions.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Page 116 of 174