Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
Identifies Node.js or IDE-related processes initiating connections to the Solana mainnet RPC endpoint. This behavior is associated with GLASSWORM's WASM loader performing dead-drop C2 resolution via blockchain transaction memos.
Detects potential fileless execution of Meow RAT by monitoring process command lines for 'curl' fetching an AppleScript payload and piping it to 'osascript'. It also looks for specific Meow RAT indicators like C2 domains, payload names, and build hashes.
Detects the use of the 'ditto' command with specific arguments indicating data staging or collection activities, particularly when archiving to a temporary location like '/tmp/osalogging.zip'. This could be indicative of an adversary collecting data from the local system before exfiltration.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects a network beacon triggered strictly during model initialization. If a Python process loads a model file and immediately establishes an outbound TCP connection to an unknown IP, it indicates an embedded payload phoning home.
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects anomalous execution patterns involving Node.js and Bun runtimes, specifically identifying suspicious process lineage such as node processes spawned by node.gyp, or Bun execution patterns involving temporary files or specific command-line arguments. Additionally, it alerts on the execution of a specific known malicious file hash.
Detects execution of node-gyp to compile native Node.js addons, which can be leveraged by attackers to execute arbitrary code or build malicious modules during project installation or development. The rule looks for binding.gyp usage and build commands initiated by npm or node processes.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Detects process start events where the command line contains the specific string 'ShitSetupOn26126k'. This appears to be a specific indicator of compromise (IOC) related to a custom script or malware installation routine.
Detects the use of Amazon Q related configuration files (.amazonq, mcp.json) in conjunction with common command-line utilities such as bash, sh, npx, or node. This activity may indicate an attempt to interact with or exploit developer tools and environment configurations to perform unauthorized reconnaissance or execution.
Page 123 of 174