Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,952
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule flags a notarised macOS Flutter application whose web view can trigger command execution. Apple notarisation does not guarantee good intent. Investigate any unfamiliar app with this pattern. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule catches a preinstall script running an obfuscated index.js before the main install completes. Preinstall runs automatically without user consent. Never ignore preinstall additions in dependency updates. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects dynamic domain resolution patterns used for C2 infrastructure rotation
Detects abuse of macOS XPC services for inter-process execution
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by JavaScript runtimes (like node or bun). This activity may indicate a supply chain backdoor attempting to establish persistence within a project by modifying development environment configurations.
This rule flags many npm republications from an account soon after suspicious token activity. Stolen maintainer tokens cause rapid malicious releases. Lock the account and audit download stats. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects download of malware source code from code repositories
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects when a single process rapidly creates or modifies three or more YAML files (files ending with '.yaml' or '.yml') within an hour. It specifically looks for these activities in paths containing 'config' or 'pipeline', which could indicate configuration changes, deployment activities, or potential malicious manipulation of system or application settings.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
Bun Runtime Remote Download
Cortex XDR
Detects network connections downloading the Bun runtime from the oven-sh GitHub repository, a behavior exhibited by the Hades loader. This rule specifically looks for HTTP network events where the URL contains 'github.com' and 'oven-sh/bun/releases/download', indicating an attempt to download the Bun runtime.
This rule detects the delivery of an AppleScript payload over HTTP. It specifically looks for HTTP responses (flow:to_client) that contain the string ".scpt" (case-insensitive) in the HTTP URI. This indicates a potential malicious script being downloaded to a client system, often used for execution on macOS systems.
Payload Ransomware File Artifacts
Cortex XDR
Detects the creation of files with the .payload extension or the RECOVER_payload.txt ransom note, indicating active encryption by Payload ransomware.
Detects enumeration of git credential helpers via 'git config --global credential.helper'. This command is used by adversaries, such as Miasma, to determine how credentials are stored (e.g., wincred, osxkeychain, store) before attempting extraction.
Detects tampering with 'binding.gyp' files by processes other than 'npm', 'node', or 'yarn'. Modifying these build scripts can allow attackers to achieve arbitrary code execution during the 'npm install' phase, indicating a potential supply chain compromise.
This rule detects attempts to modify macOS Plist files over an SSH connection. Specifically, it looks for TCP traffic on port 22 (SSH) where the payload contains both '/Library/Preferences/' and '.plist' (case-insensitive). This activity is flagged as potential defense evasion, as modifying Plist files can be used to alter system behavior or application settings to evade security mechanisms.
Page 143 of 174