Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the macOS script reading a downloaded text file, decoding the Base64 contents, and piping it to execution.
Detects outbound network connections from workstations or servers to common message broker ports (MQTT 1883/8883, AMQP 5672). These protocols are sometimes abused for command-and-control (C2) communication, as they allow for pub/sub messaging patterns that can blend into legitimate network traffic.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware or cryptocurrency-related threats attempting to resolve dynamic commands or addresses.
This rule detects network connections where a non-browser process (specifically excluding Chrome, Edge, and Firefox) attempts to resolve dynamic commands or addresses using the JSON-RPC 'eth_call' method. It specifically targets scenarios where this activity is associated with known malware structures like SessionGate, Remus, or AnimateClipper, rather than a standalone executable name. The detection logic looks for 'eth_call' in either the DomainName or the ContextProcessCommandLine fields during network connection events.
Detects Electron applications attempting to establish persistence using `setLoginItemSettings` in conjunction with JavaScript code execution (`eval`) or external process execution (`child_process` and `execFile`). This combination is indicative of malicious activity, such as that observed in Clickfix attacks, where an application gains persistence and then executes arbitrary code.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects the use of the `sysadminctl` utility with the `addUser` or `-addUser` command-line arguments, which can be used to create new user accounts on macOS systems. This activity could indicate an adversary attempting to establish persistences by creating new accounts.
Loader used in click-hijacking traffic distribution scheme
Infostealer distributed via fake open-source tool impersonation sites
Infostealer distributed via fake open-source tool impersonation sites
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
MINIRAT C2Beacon
YARA
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
Photo-themed ZIP phishing campaign dropping a Node.js implant
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
Page 120 of 174