Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
This rule monitors DNS query logs for attempts to resolve domains associated with 'rrweb' or 'rrweb-snapshot'. These libraries are legitimate tools for session recording and DOM snapshotting but have been increasingly observed in malicious activity, specifically in web-based credential theft, automated session hijacking, or exfiltration of sensitive user activity via session recording.
Detects the execution of a malicious Node.js process using a fake ESLint loader named 'vscode-eioesocxetd.js'. This malware persists by modifying the global 'require' function and setting the 'global['!']' property to ensure its presence across process restarts, typically masquerading within npm package directories.
Detects HTTP GET requests to api.adblock-for-youtube.com to retrieve scriptlet rules. This endpoint is used by various browser extensions to fetch dynamic configuration updates, which can potentially facilitate MAIN-world JavaScript injection.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
This rule detects potentially malicious browser activity by monitoring for Google Chrome outbound network connections to known command-and-control (C2) domains associated with malicious browser extensions (e.g., BadBlocker). It also flags the installation or loading of specific, known-malicious browser extension IDs on endpoints.
This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.
Detects macOS.Gaslight malware activity through two branches: direct hash matches of known binaries and the spawning of Python subprocesses with specific command-line arguments indicative of data collection or archiving. The Python subprocess detection looks for Python scripts being executed from '/tmp/' or '/Library/' directories with arguments related to browser data collection, keychain access, or archiving operations.
Detects suspicious attempts to access macOS Keychain or browser credentials (Chrome, Firefox) using 'osascript' or 'security' command-line utilities. This rule identifies patterns indicative of credential dumping or access, such as unlocking keychains, finding generic passwords, or accessing browser-specific credential files.
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
This rule detects suspicious access to macOS Keychain files or the use of the 'security' utility to manipulate keychains. It specifically looks for 'osascript' accessing keychain-related paths, the 'security' utility using commands like 'unlock-keychain' or 'find-generic-password', or common shell utilities ('cp', 'cat', 'sh', 'bash', 'zsh') accessing keychain database files. This activity is often indicative of credential access attempts.
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
Detects suspicious child processes spawned by VS Code extension hosts (node.exe, code.exe, code-server, cursor) that indicate potential abuse, possibly related to WASM syscall/js bridge exploitation. The rule specifically looks for common command-line patterns used for downloading and executing payloads, such as those seen in GLASSWORM WASM loader attacks.
This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.
Detects osascript execution for macOS system interaction
This rule detects attempts to access macOS Keychain credentials or web browser stored credentials using the 'security' command-line utility. It specifically looks for 'security unlock-keychain' and 'security find-generic-password' commands, with the latter also checking for common browser names like Chrome, Brave, and Microsoft Edge. This activity is indicative of an adversary attempting to dump credentials from the system.
This rule detects the execution of AppleScript (osascript) to display fake System Preferences dialogs and the use of 'dscl . authonly' to validate credentials, which is indicative of the Meow RAT attempting to harvest macOS login passwords. The rule specifically looks for keywords in the command line that suggest a fake dialog (e.g., 'display dialog', 'LockedIcon.icns', 'System Preferences', 'hidden answer', 'default answer') or authentication validation via dscl.
Detects malicious installer packages with custom actions for persistence
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Page 118 of 174