Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,952
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the use of 'launchctl load' to activate the gh-token-monitor LaunchAgent persistence mechanism immediately after creation.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Identifies devices with FFmpeg installations below version 9.0 that include the vulnerable MagicYUV decoder (libavcodec), exposing the host to heap out-of-bounds write RCE via crafted AVI, MKV, or MOV files (CVE-2026-8461).
Detects automated execution of hidden workspace scripts triggered upon opening IDE folders, specifically looking for bash or sh processes executing 'vendor/run-update.sh' initiated by VS Code or Cursor.
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Detects connections to cryptocurrency mining pools
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
Detects the creation, modification, or renaming of the 'com.finder.helper.plist' file in the '/Library/LaunchDaemons/' directory, which is a specific persistence mechanism used by the AMOS stealer malware. This rule specifically targets the root-level persistence method.
This YARA rule detects the presence of a credential stealer by identifying a cluster of file names commonly associated with Firefox profile data. The rule specifically looks for at least five out of seven distinct file names: 'key4.db', 'cert9.db', 'cookies.sqlite', 'logins.json', 'formhistory.sqlite', 'places.sqlite', and 'prefs.js'. These files are critical components of a Firefox profile, storing sensitive information such as encryption keys, certificates, cookies, login credentials, browsing history, and user preferences. The co-occurrence of these file names within a scanned target suggests an attempt to access, exfiltrate, or manipulate Firefox user data, often indicative of malware like credential stealers.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
This rule detects a multi-step execution chain where Node.js (or npm) spawns a shell process, which then launches Bun. This pattern has been observed in malicious packages to hide the final payload from simple scanners. It is crucial to review the full parent-child process tree for any alerts. Users should be questioned about recent software installations or clicked links, and security teams should be involved if the activity is suspicious.
Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects installation of rootkit kernel modules for deep system hiding
Detects internal proxy connections used to relay C2 traffic through network
Detects use of WHOIS web services for domain property enumeration
Detects modification of macOS plist files to hide processes or enable autostart
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects process command lines that contain patterns indicative of obfuscated payload execution, specifically the combination of 'eval', 'base64', and '-d'. This technique is frequently used by adversaries to decode and execute memory-resident stages without dropping secondary payloads to disk.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Page 139 of 174