Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects a user mounting a deceptive .dmg file (e.g., posing as a crypto wallet or developer tool) resulting in the immediate execution of a hidden binary. The rule specifically looks for 'hdiutil attach' followed by a process execution from within a mounted volume that matches a common application or shell script path.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Hunts for curl or wget pulling secondary stage obfuscated payloads from Pastebin or GitHub Gists initiated by developer tools.
Detects potential credential theft activity where a user or compromised process executes shell commands to inspect environment variables, AWS credential files, or project configuration files (e.g., .env) for sensitive secrets such as API keys and access tokens.
Detects the creation or modification of '.env' files within '.gemini' directories, often found in CI/CD pipelines or developer environments. This activity may indicate an attempt to inject malicious environment variables to hijack the execution flow of the Gemini CLI or related tooling.
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects the execution of a custom Mach-O binary designed to fake system password prompts (UNK_DeadDrop). This activity is indicative of credential phishing attempts on macOS systems.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects the download of a standalone CPython 3.10.18 interpreter from github.com/astral-sh/python-build-standalone using curl, followed by the extraction of the compressed archive using tar. This behavior is associated with the macOS.Gaslight malware's secondary collection module installer, which likely prepares a localized Python environment to execute further malicious tasks.
Detects the AMOS infostealer staging collected system data by using the macOS ditto utility to compress information into a hidden .hipr directory. The rule identifies the execution of ditto with .hipr in the command line in conjunction with the creation of User_Name.txt and System_Information.txt within that same directory.
Detects the AMOS infostealer attempting to access and enumerate browser extension directories on macOS to harvest cryptocurrency wallet data from Chrome and Firefox profiles.
Page 129 of 174