Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,628 detections
Filters
Last updated
All Time
Detection languages
1,752
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,490
1,153
779
528
515
Platforms
39,937
7,246
6,535
3,864
3,628
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
573
523
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects a suspected ClickFix phishing sequence where a user navigates to a brand-impersonating GitHub organization or repository, followed by a redirection within a short timeframe to a GitHub Pages portal hosting malicious content. The rule also monitors for direct navigation to a known common lure-hosting domain.
This rule monitors for network communication with a specific known malicious IP address and URL path, as well as the execution or presence of associated malicious file hashes. Additionally, it flags emails involving specific indicators identified as potentially associated with malicious activity.
This rule monitors for network communication with a specific known malicious IP address and URL path, as well as the execution or presence of associated malicious file hashes. Additionally, it flags emails involving specific indicators identified as potentially associated with malicious activity.
This rule monitors for network communication with a specific known malicious IP address and URL path, as well as the execution or presence of associated malicious file hashes. Additionally, it flags emails involving specific indicators identified as potentially associated with malicious activity.
Detects a specific multi-stage exfiltration pattern characterized by initial reconnaissance/fingerprinting probes against sensitive service endpoints (/health, /docs, /openapi.json) followed by unauthorized access to artifact storage endpoints (/files or /file?name=) from the same device against the same host within a short timeframe.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
This rule detects potential AI prompt injection attacks delivered via email. It identifies users clicking external links directed at AI platforms (like OpenAI, Claude, or Perplexity) that contain suspicious URL parameters or instructions designed to manipulate or override the AI's standard behavior. It correlates the web request with a subsequent process execution on the host that includes suspicious keywords in the command line, suggesting an attempt to automate or exploit the AI assistant through local system interaction.
Detects potential supply chain or local configuration tampering involving the Model Context Protocol (MCP). The rule identifies modification of common MCP configuration files, followed by the execution of a tool runner (node, python, npx) that spawns a scripting shell, which subsequently initiates an unusual outbound network connection.
Detects anomalous discovery behavior originating from known AI agent and development tools (e.g., Claude, Cursor, Aider). The rule monitors for a rapid sequence of commands spanning multiple categories of enumeration (Network, File/Directory, Software, and System) within a short timeframe, which indicates an attempt to map the runtime environment, permissions, or system capabilities.
Detects anomalous AI-assisted activity where multiple processes (specifically AI developer tools) appear to be chaining operations by writing to and reading from shared local directories (e.g., 'handoff', 'artifacts') followed by network requests to known AI service APIs. This pattern may indicate automated task chaining or unauthorized exfiltration of context/code to AI platforms.
Detects the on-disk presence of a malicious Firefox browser extension, 'pdf-para-texto@extensao.local', used for credential or data harvesting. The rule monitors for the creation of its manifest file or XPI package in specific directories, indicating the staging or installation of the malicious extension.
This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by
the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and
Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or
perform post-exploitation activity.
the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and
Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or
perform post-exploitation activity.
Detects specific malicious Mach-O binary payloads associated with the Atomic macOS Stealer (AMOS) discovered in the Macfinger ClickFix campaign. The rule uses static file hashes to identify these specific samples.
Detects specific malicious Mach-O binary payloads identified as Atomic Stealer (AMOS) that are associated with Macfinger ClickFix first-stage infection campaigns. The rule uses static file signatures (Mach-O headers), specific file size ranges, and known SHA-256 hashes of the payloads.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying outbound HTTP POST requests to the '/api/t' URI path occurring on non-standard ports. The detection utilizes a threshold-based trigger to identify potential C2 communication heartbeats.
This rule monitors package installation logs for indicators of packages potentially generated or suggested by AI tools (e.g., Copilot, code assistants) being installed in a target environment. It specifically looks for a low volume of installations (<=3) for packages that have been published within the last 14 days, which is a pattern often associated with the 'Publish Hallucinated Entities' technique in AI systems, where malicious or hallucinated code packages are introduced into the supply chain.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
This rule detects activities associated with the MacSync backdoor, specifically focusing on persistence mechanisms such as LaunchAgent manipulation, .repair-run scripts, and suspicious GIT hook usage. It also correlates these events with the termination of macOS notification agents (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent), which is a tactic used to suppress security alerts during malicious operations.
Page 13 of 173