Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
This rule detects suspicious activity related to a specific IP address (142.11.206.73) in network connections, or a specific domain (sfrclak.com) in DNS requests or process command lines. This could indicate communication with known malicious infrastructure or the execution of malware.
This searches for instances of Trivy, and communicates to the attacker controller server using the domain name and IP address.
Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.
This rule detects DNS requests to domains known to be associated with malicious browser extensions. These extensions often perform command and control (C2) or data exfiltration activities by communicating with these domains. The rule uses a regex to match both the primary domains and their subdomains, aggregating results by host and domain to identify repetitive beaconing.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Detects macOS Gatekeeper bypass via xattr utility
Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.
Detects instances where the legitimate Obsidian application spawns shell or scripting interpreters (PowerShell, cmd, sh, bash, zsh). This behavior is associated with the REF6598 campaign, where attackers abuse the Obsidian "Shell Commands" community plugin to execute malicious code and deliver the PhantomPulse RAT.
Detects deletion of local audit logs
Detects attempts to enable the guest account using the sysadminctl utility
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Identifies the creation of a specific LaunchAgent plist file associated with the PhantomPulse macOS AppleScript dropper, indicating persistence on macOS systems.
Provides high-fidelity detection of the initial infrastructure used by the threat actor to deliver the PhantomPulse RAT. This rule specifically detects network connections to a known PhantomPulse staging server IP address.
Page 151 of 174