Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects unauthorized access or modification to common CI/CD credential files (.npmrc, .pypirc, .git-credentials, jenkins credentials.xml) and CI/CD configuration files (.github/workflows, .gitlab-ci.yml). The rule monitors both file system activities by non-standard processes and the execution of command-line tools that reference these sensitive files.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
Detects file creation or modification events targeting sensitive cloud credential storage locations, such as AWS credentials files, Azure configurations, and Google Cloud credentials databases. The rule filters out known legitimate CLI tools, flagging potential unauthorized access or exfiltration of cloud credentials by other processes.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects file creation or modification events targeting sensitive cloud credential storage locations, such as AWS credentials files, Azure configurations, and Google Cloud credentials databases. The rule filters out known legitimate CLI tools, flagging potential unauthorized access or exfiltration of cloud credentials by other processes.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It leverages an external CSV file containing these IP ranges for both IPv4 and IPv6. This can be used to detect or monitor traffic potentially obfuscated by iCloud Private Relay.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
Detects curl or wget fetching a secondary payload (like AMOS or ClearFake) directly into the /tmp directory, a volatile location to hide execution artifacts. The rule specifically looks for command-line arguments that use '-o' to specify a destination path within /tmp with common executable or package extensions.
Detects the installation of known malicious PyPI packages ('frint', 'skytext', 'slogsec', 'logcrypt.cryptography') associated with the ChocoPoC supply chain campaign. The rule monitors process execution commands related to 'pip' package installation and tracks the appearance of malicious compiled extension files ('gradient.pyd', 'gradient.so') on the filesystem.
Detects developers cloning a repository (mimicking a coding interview test) and immediately executing an anomalous binary or script hidden within the project structure. This behavior is indicative of the Void Dokkaebi threat actor's tactics.
Identifies package managers (npm, pip) executing pre-install scripts that perform immediate system reconnaissance (whoami, hostname, sw_vers, systeminfo) characteristic of Void Dokkaebi payloads. This rule looks for a sequence where a package manager initiates a process, and that initiated process then launches a reconnaissance command.
Detects anomalous system and process enumeration activity characteristic of the macOS.Gaslight threat, specifically looking for repeated execution of diagnostic commands like ps, sysctl, uname, and sw_vers in a short timeframe, which suggests an attempt to profile the infected host environment.
Detects execution of the macOS.Gaslight Rust-based implant. The rule identifies the specific malicious binary by its SHA-256 hash and targets its behavior of using runtime dynamic symbol resolution (via dlsym) to hide API calls from static analysis.
Detects the macOS.Gaslight Rust-based implant receiving and executing backdoor commands (e.g., shell, kill, upload, persistence) via the Telegram Bot API. The rule correlates outbound network connections to api.telegram.org with subsequent process execution patterns typical of command dispatch (such as execvp or posix_spawnp).
Detects unauthorized processes accessing browser credential databases (e.g., Login Data, Cookies, Web Data) associated with Chromium-based browsers on macOS. This behavior is indicative of credential harvesting often performed by infostealers like AMOS (Atomic macOS Stealer).
Detects potential malware execution chains characteristic of AMOS (Atomic macOS Stealer) and related 'ClickFix' campaigns. The rule monitors for the silent downloading of a disk image (.dmg) file to the /tmp directory using curl with quiet flags, followed immediately by the mounting of that image using hdiutil with the -nobrowse flag to bypass user notification and Gatekeeper security prompts.
Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.
Detects the creation of a LaunchAgent property list (.plist) file on macOS that uses a spoofed Apple namespace label (com.apple.system.services.activity). This behavior is characteristic of the Gaslight malware family attempting to establish persistence.
Detects malicious Python or JavaScript package archives (such as those used in dependency confusion attacks) that contain obfuscated code execution logic (base64 encoded commands) within package installation hooks (setup.py), or those embedding suspicious binary executables (PE/ELF headers) within the package structure.
Detects unauthorized access to browser data and local credential stores initiated by the 'openclaw' or 'money-radar' malicious agent process trees. The rule monitors for file access events targeting sensitive credential files on Windows and macOS systems, which is characteristic of the ClawHub stealer malware.
Detects the creation of local user accounts on macOS using the 'dscl' command-line utility, specifically looking for the '-create' action within the '/Users/' directory and the presence of 'UniqueID' or 'IsHidden' parameters. The rule excludes common system-related UniqueIDs (0, 1, 202, 205, 248) to reduce false positives from legit system operations.
Page 117 of 174