Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects the use of the Electron setLoginItemSettings API for startup persistence. This API allows Electron-based applications to configure themselves to launch automatically when a user logs in, which can be abused by adversaries to maintain access to a system.
Detects processes making network requests to the '/cf.js' endpoint, which is indicative of ErrTraffic activity. This rule specifically looks for network events where the remote URL ends with '/cf.js'.
Detects the execution handoff from a malicious JavaScript extension within VS Code to host-specific execution agents. This includes compiled Windows executables like 'monitor-agent.exe', 'job-agent.exe', 'processor-service.exe', and Python processes executing Linux/macOS agent scripts such as 'handler-agent.py', 'monitor-agent.py', 'processor-agent.py'. The detection logic filters for processes initiated by 'node.exe', 'electron.exe', or 'code.exe'.
Detects ptrace access to securityd process memory for credential extraction
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Detects attempts to bypass macOS Gatekeeper security controls
This rule alerts when a new format-check workflow is created matching malicious supply-chain templates. These workflows run on every push and can steal secrets. Require security review for all new workflow files. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects large HTTPS uploads used for data exfiltration over encrypted channels
Detects C2 configuration retrieval via Pastebin and similar dead drop services
Detects downloads of typosquatted packages from npm or PyPI
Detects downloads of typosquatted packages from npm or PyPI
Detects addition of malicious login items on macOS for user-context persistence
This rule detects the execution of script interpreters (such as PowerShell, cmd, bash, python, etc.) where the command line contains non-ASCII characters, specifically Cyrillic, Arabic, or Chinese Unicode characters. This pattern can be indicative of obfuscation techniques used by adversaries to evade detection or to target specific regions.
This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects use of macOS resource forks to hide malicious data
Blockchain eth_call Command Resolution
Cortex XDR
This rule detects JSON-RPC 'eth_call' usage originating from a non-browser process, which could indicate dynamic command or address resolution related to blockchain interactions. The XQL view retains actor and causality fields to aid in investigation.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Page 141 of 174