Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Identifies the creation of a specific LaunchAgent plist file associated with the PhantomPulse macOS AppleScript dropper, indicating persistence on macOS systems.
Provides high-fidelity detection of the initial infrastructure used by the threat actor to deliver the PhantomPulse RAT. This rule specifically detects network connections to a known PhantomPulse staging server IP address.
Detects usage of base64 utility to decode arbitrary base64-encoded text
Detect file time attribute change to hide new or changes to existing files
Detects attempts to enable the root account via "dsenableroot"
Multi-layered detection for two linked March 2026 threat campaigns identified by ANY.RUN and Objective-See:
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
Detects attempts to manually remove the Apple quarantine extended
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Hidden User Creation
Sigma
Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
Detects disabling security tools
Detects attempts to create and add an account to the admin group via "dscl"
Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.
Detects the execution of the nscurl utility in order to download files.
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects attempts to create and add an account to the admin group via "sysadminctl"
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
This process is primarily used to detect and avoid virtualization and analysis environments.
Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
Page 152 of 174