Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
This rule detects the forced removal of legitimate cryptocurrency wallet applications (Ledger Wallet, Trezor Suite, Exodus) followed by the extraction of new applications into the /Applications directory on macOS. It also looks for chmod commands to make the new applications executable and attempts to download suspicious zip files from 'wusetail.com'. This activity is indicative of the AMOS malware campaign, which aims to replace legitimate wallet applications with trojanized versions to steal cryptocurrency.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
This rule detects the multi-stage installation and command-and-control (C2) activities associated with GhostClaw or GhostLoader malware on macOS systems. It correlates suspicious process executions, such as curl-based bootstrap, install.sh execution, user-space Node.js setup, and outbound network traffic to 'trackpipe.dev' with UUID-like pathing or specific NODE_CHANNEL values. The rule looks for a combination of at least three of these indicators within a two-hour window to reduce false positives.
This rule detects outbound network connections to the domain 'trackpipe.dev', which is associated with the GhostClaw/GhostLoader macOS malware. It specifically looks for UUID-like identifiers in the URL path, indicating per-repository communication patterns used by the malware.
This rule detects the presence of specific 'NODE_CHANNEL' values ('anglmf', 'cryptoexth4', 'complexarchaeologist1') in process command lines or network event initiating process command lines on macOS systems. These values have been observed in the GhostClaw/GhostLoader malware campaign, indicating potential execution or network communication related to this threat.
This rule detects an AMOS-style macOS AppleScript loader. It identifies a combination of execution chain strings. The rule requires a specific number of these elements to be present, along with a magic byte check or the string 'osascript -e'.
Detects codesign --sign - used to ad-hoc sign a payload dropped to /private/tmp by a non-system process
Detects the macOS RAT com.apple.act.mond beaconing via HTTP POST with spoofed IE8 User-Agent which was spread via axios supply-chain attack
This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.
Detects the execution of `system_profiler` querying memory and hardware data types. Atomic Stealer (AMOS) utilizes these environmental awareness checks prior to execution to evade analysis by determining if it is running within a virtual machine environment.
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects instances of the openssl command-line tool being used to encrypt data with AES-256-CBC and RSA OAEP padding. This specific sequence matches the credential encryption pattern observed in the Linux/macOS payload of the malicious telnyx PyPI package attributed to TeamPCP.
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
Page 154 of 174