Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects copying or writing certificate material and modifications to system keychains. Execution of `security add-trusted-cert`.
This rule detects network connections (both inbound and outbound) on TCP/UDP port 18789, excluding connections initiated by processes from well-known publishers like Microsoft, Apple, and Google. This port is not commonly used by legitimate applications and could indicate the presence of custom malware, command and control (C2) communication, or other unauthorized network activity.
UD Crypt (fudcrypt.net) is a Malware-as-a-Service crypter platform ($800–$2,000/month) that produces polymorphic Windows loaders carrying valid Microsoft-chained Authenticode signatures via Azure Trusted Signing abuse. The signature chains to the "Microsoft Identity Verification Root CA", bypassing SmartScreen and EV-signing checks. The loader abuses DLL sideloading into legitimate signed binaries (Zoom, Slack, VS Code, OneDrive, CCleaner, ProtonVPN, WindowsDF.exe → mpclient.dll), patches AMSI and ETW in-memory, masquerades the PEB as explorer.exe, and beacons via WSS to mstelemetrycloud.com. In a 38-day observation window: 200 operators, 334 builds, 2,093 C2 commands, 32 confirmed victims.
This rule detects the execution of a 'curl' command on macOS that attempts to make a POST request to a file named 'salmonela' within the '/tmp/' directory. This pattern is highly suspicious and could indicate an attempt to exfiltrate data, upload malicious content, or interact with a temporary malicious script.
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
This rule detects suspicious activity related to a specific IP address (142.11.206.73) in network connections, or a specific domain (sfrclak.com) in DNS requests or process command lines. This could indicate communication with known malicious infrastructure or the execution of malware.
This searches for instances of Trivy, and communicates to the attacker controller server using the domain name and IP address.
Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.
This rule detects DNS requests to domains known to be associated with malicious browser extensions. These extensions often perform command and control (C2) or data exfiltration activities by communicating with these domains. The rule uses a regex to match both the primary domains and their subdomains, aggregating results by host and domain to identify repetitive beaconing.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Detects macOS Gatekeeper bypass via xattr utility
Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.
Detects instances where the legitimate Obsidian application spawns shell or scripting interpreters (PowerShell, cmd, sh, bash, zsh). This behavior is associated with the REF6598 campaign, where attackers abuse the Obsidian "Shell Commands" community plugin to execute malicious code and deliver the PhantomPulse RAT.
Detects deletion of local audit logs
Detects attempts to enable the guest account using the sysadminctl utility
Page 151 of 174