Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of AppleScript with the presence of 'character id' in loops. This pattern is often used by malware to hide malicious AppleScript code.
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects execution of a base64 decoded payload piped directly into the zsh shell. This technique is highly indicative of ClickFix social engineering campaigns, where users are manipulated into copying and pasting malicious one-liners into their macOS terminal to bypass Gatekeeper and execute malware such as AMOS.
Detects the execution of an osascript command that queries system_profiler for SPMemoryDataType and checks for virtualization software strings like QEMU or VMware. This technique is actively used by the Atomic macOS Stealer (AMOS) to evade automated analysis environments and sandboxes.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Detects the use of the curl command-line utility to perform an HTTP POST request uploading a .zip archive. This behavior is characteristic of the exfiltration phase used by macOS malware, such as Miolab Stealer, to silently transfer staged sensitive files and system profiles to a remote command-and-control server.
Identifies a process that has successfully modified the /etc/sudoers file. The sudoers file controls which users have administrative privileges and whether they require a password to execute commands as root. Unauthorized changes to this file are a primary method for attackers to gain permanent, passwordless "root" access to a system. This rule correlates the initiator process with the file modification event to identify the source of the change.
This rule detects the creation, modification, or renaming of directories related to the malicious 'plain-crypto-js' npm package within a 'node_modules' folder. This activity is indicative of a supply chain compromise where a legitimate package (Axios) was found to include this malicious dependency.
This rule detects the creation, writing, or renaming of specific files associated with the compromised Axios npm package versions 1.14.1 and 0.30.4. Upon installation, the postinstall script of these compromised packages deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. The rule specifically looks for file paths indicative of these dropper activities across different operating systems.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects the use of the macOS native ditto command to compress files and directories into a .zip archive. This technique is frequently used by macOS stealers, such as Miolab and AMOS, to quietly stage collected sensitive documents (PDFs, TXTs, RTFs) and profile data before exfiltrating it to a remote command-and-control server, avoiding the need to drop noisy third-party archiving tools.
Detects the execution of the native macOS dscl utility with the -authonly flag. This technique is used by malware, such as Miolab Stealer, to silently validate phished user credentials captured via fake authentication prompts before escalating privileges or exfiltrating data.
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
This rule detects the first stage of activity once a compromised endpoint runs the affected Axios package (versions 1.14.1 and 0.30.4). It specifically looks for process creation events where the command line contains a call out to the C2 domain 'sfrclak.com'. This indicates the dropper scripts attempting to establish communication with their command and control server.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.
Page 153 of 174