Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Identifies execution of the Linux/macOS bash cradle used by GLASSWORM's WASM loader. It looks for curl fetching the specific OS path structure ('/linux/i/_' or '/darwin/i/_') and piping to bash.
Detects the execution of the macOS 'ditto' command used to compress and stage files into the /tmp directory, specifically looking for the creation of zip archives. This behavior is associated with Amos Stealer prior to data exfiltration.
Detects use of Discord webhooks for covert C2 or data exfiltration
Detects removal and replacement of Chrome.app on macOS to bypass Manifest V3.
This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.
This rule detects the execution of multiple common macOS utilities ('ps', 'system_profiler', 'sw_vers', 'sysctl', 'uname') with specific command-line arguments often used for system information discovery. The rule identifies instances where these commands are executed by a single initiating process, excluding common shell processes, and flags executions originating from suspicious temporary or library paths.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
Detects activity associated with the macOS.Gaslight credential stealer, specifically focusing on Python processes accessing the login.keychain-db, browser credential stores, creating a 'collected_data.zip' archive, and executing security or reconnaissance commands. This rule identifies file events (creation, modification, read, copy) related to keychain and archive staging, as well as process events involving the 'security' command for password extraction and 'ps' or 'system_profiler' for system reconnaissance, all initiated by Python.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
This rule detects attempts to enumerate keyboard input sources or search for Russian keyboard layouts on macOS systems. This activity can be indicative of an adversary performing a 'geofence' check to determine the system's locale or origin, potentially to avoid targeting specific regions.
Detects attempts to copy sensitive configuration or credential files (e.g., .ssh, .zshrc, .bash_history, .gitconfig, .kube, .aws) to a suspicious temporary directory '/tmp/sync' on macOS systems using common shell commands like 'cp', 'bash', 'zsh', or 'sh'. This activity could indicate an adversary staging data for exfiltration or further malicious use.
Correlates processes executing commands containing 'megalodon' with outbound network connections to a specific C2 IP address (216.126.225.129). This rule aims to detect data exfiltration or command and control communication associated with the Megalodon malware.
This rule detects suspicious script execution on macOS devices that targets known cryptocurrency wallet applications or data files. It looks for command-line executions involving common shell interpreters (sh, bash, zsh, osascript) that contain strings associated with Ledger Live, Trezor Suite, Exodus, Electrum, or generic 'wallet.dat' files. This activity could indicate an attempt to steal cryptocurrency wallet information or funds.
Correlates the stealer invoking system_profiler to search for virtualization or security strings (e.g., VMware, Parallels) to halt execution in sandboxes.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
This rule identifies the execution of MeshCentral for remote command execution, specifically looking for command-line arguments containing 'meshctrl.js' and 'RunCommand'. This activity has been observed in attacks such as those by ShinyHunters to stage payloads on compromised Oracle PeopleSoft servers.
Detects the creation of common ransomware note file names with suspicious extensions.
Detects the explicit execution of the 'gh-token-monitor.sh' script, which is indicative of active credential harvesting on the endpoint. This script is designed to monitor and potentially exfiltrate GitHub tokens.
Page 135 of 174