Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects creation of Emond rules for macOS event monitor persistence
Detects modification of macOS re-opened applications list for persistence on login
Detects launchctl used to load services for macOS persistence or execution
Detects the initial execution phase of the Phantom Gyp technique where a node-gyp rebuild command is abused to execute a silent payload and return a fake C stub file. This behavior is associated with the Miasma npm supply chain attack.
Detects modification of macOS plist files to hide processes or enable autostart
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects legitimate software deployment tools used for remote execution
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Hades Bun Payload Execution
Cortex XDR
Detects the execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This indicates potential malicious activity associated with the Hades PyPI campaign.
This rule detects attempts to execute AppleScript commands remotely over SSH. It specifically looks for the string "osascript" (case-insensitive) within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential remote execution of AppleScript.
Detects loading of kernel modules for deep system persistence
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
Detects setting IsHidden on a macOS user record to suppress the account from the login screen.
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
This rule detects network traffic containing the string "LSSharedFileList" (case-insensitive) on TCP port 22 (SSH). This string is associated with macOS Login Items, which can be used for persistence by adversaries. The rule specifically looks for this content in traffic flowing from the client to the server.
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
Page 144 of 174