Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects usage of base64 utility to decode arbitrary base64-encoded text
Detect file time attribute change to hide new or changes to existing files
Detects attempts to enable the root account via "dsenableroot"
Multi-layered detection for two linked March 2026 threat campaigns identified by ANY.RUN and Objective-See:
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
Detects attempts to manually remove the Apple quarantine extended
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Hidden User Creation
Sigma
Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
Detects disabling security tools
Detects attempts to create and add an account to the admin group via "dscl"
Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.
Detects the execution of the nscurl utility in order to download files.
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects attempts to create and add an account to the admin group via "sysadminctl"
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
This process is primarily used to detect and avoid virtualization and analysis environments.
Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
Detects the execution of AppleScript with the presence of 'character id' in loops. This pattern is often used by malware to hide malicious AppleScript code.
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Page 152 of 174