Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects macOS Terminal (bash/zsh) retrieving 'loader.sh' or 'payload.applescript' directly from the ClickFix attacker infrastructure, indicating potential compromise related to the ClickFix campaign.
Detects the final curl command transmitting archived credentials to a remote C2 via a multipart form-data upload, specifically looking for curl commands that use '-X POST' and '-F file=@/tmp/.*.zip' to upload a zip file from the /tmp directory.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Identifies the AppleScript stealer validating the phished user password locally using the dscl . -authonly command.
Detects curl POST requests sending JSON telemetry to attacker endpoints post-infection, specifically looking for patterns associated with the ClickFix campaign.
Identifies the creation of a LaunchAgent property list masquerading as 'com.google.keystone.agent.plist'. This behavior is associated with the ClickFix campaign, which uses fake macOS utilities to deliver infostealers.
Detects the creation of the .agent shell wrapper file designed to supervise and restart the .mainhelper backdoor process.
Identifies the first-stage script downloading the Mach-O binary payload directly into /tmp/helper or /tmp/update using 'curl'.
Correlates the stealer invoking system_profiler via osascript to search for virtualization strings to halt execution in sandboxes.
Correlates the creation and immediate deletion of the trin.tar.gz archive handled by the Python temporary-directory context manager.
Correlates local LLM execution engines (Ollama, LM Studio) unexpectedly spawning command shells, a strong indicator of successful prompt execution payloads.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects instances where a process associated with the 'brand-landingpage' AI agent or processes involving scripts from 'stitch-design.ai' spawn child processes, potentially indicating malicious activity leveraging the agent's runtime permissions.
Detects the execution of a Python-based collection module associated with the Gaslight malware on macOS. The module performs reconnaissance by enumerating system information using 'system_profiler' and running processes via 'ps aux', followed by the collection of sensitive data including browser files and the login keychain.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Detects the execution of osascript spawned directly from the Terminal application, a pattern identified in Meow RAT campaigns using ClickFix social engineering lures to execute malicious AppleScript in-memory.
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects unauthorized access to cloud provider credential files (AWS, GCP, Azure) by potentially suspicious processes. It specifically monitors processes such as node.exe, npm, python, bash, or binaries running from temporary directories (/tmp, %TEMP%) while excluding legitimate CLI tools.
Detects unauthorized access to browser credential storage files (e.g., Login Data, Cookies, Local State) by suspicious non-browser processes such as node.exe, powershell.exe, or wscript.exe. This activity is often associated with infostealer malware, particularly in supply chain attacks where malicious scripts attempt to dump browser-saved credentials or session cookies.
Page 134 of 174