Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,632 detections
Filters
Last updated
All Time
Detection languages
1,757
374
349
273
255
Contributors
908
666
593
359
164
Categories
1,494
1,158
779
528
520
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
578
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
Detects 'osascript' (AppleScript) executing 'curl' to download a second-stage payload. This updated rule is tuned to detect specific indicators from a known campaign, such as the use of silent/insecure flags, downloads to hidden script files (e.g., .ex.scpt), or connections to known malicious domains.
Detects the renaming of the macOS TCC (Transparency, Consent, and Control) directory. This is a specific evasion technique where malware renames the directory to 'com.appled.tcc' to release file locks on the TCC.db, allowing for the injection of permissions.
This rule detects the execution of specific Node.js scripts associated with the StegaBin package campaign. It looks for 'node.exe' or 'node' processes executing command lines containing 'scripts/test/install.js' or 'vendor/scrypt-js/version.js'. The intent is to identify the initial phase of a malicious package installation chain, which could lead to further compromise.
Detects the "EtherHiding" technique used by the FakeGit campaign. The malware queries a Polygon Mainnet smart contract via a public RPC node to resolve its current C2 server address. This rule looks for network connections to known blockchain RPC providers containing the specific function selectors used by the malware's V1 and V2 contracts.
Detects a high volume of network connections from a browser process to a high port on the local host (127.0.0.1 or ::1). This pattern can indicate a malicious website attempting to brute-force credentials for a local service, such as the OpenClaw AI agent, by abusing the browser's permission to establish WebSocket connections to localhost. The vulnerable service may not rate-limit these local connections, allowing for rapid password guessing.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
This rule detects the execution of a process that attempts to build an executable using 'zig build-exe' and subsequently initiates a process with a command line containing 'https://github.com/nullclaw/nullclaw.git'. This could indicate an adversary building a malicious executable on a host and then attempting to download or interact with a malicious GitHub repository, potentially for further stages of an attack.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Detects broad filesystem searches using native OS commands ('dir' on Windows, 'find' on Linux/macOS) for files containing sensitive developer information like private keys, mnemonic phrases, and configuration files. This TTP is used by modules 5 and 6 of the StegaBin toolkit.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
This query identifies devices that have specific software installed, enriching this information with device details like OS, exposure level, and internet-facing status. This is useful for asset inventory and identifying potentially exposed endpoints, especially when vulnerability information might not be immediately available through other means. The current rule is configured to detect "Acronis Cyber Protect" software.
This rule helps identify suspicious repository files that may try to run code automatically when a developer opens a project in an editor or when a build starts. It searches for the exact wording used by the editor to auto run tasks when a folder is opened, and it also looks for a set of web addresses published in public reporting that were used to deliver additional code. A match does not always mean the repository is malicious, but it does mean the file deserves careful review before it is executed on a developer machine. If you see a hit, confirm the repository source, check for unexpected scripts or obfuscated code, and review recent network traffic for connections to the listed staging sites. If the repository is not clearly trusted, isolate the environment, remove the project from production developer workstations, and rotate any secrets that may have been available. This rule is meant to provide a clear and understandable safety check for teams that regularly clone and run new code.
Detects the execution of a shell command that decodes a base64 string and pipes the output directly into another shell for execution. This is a common obfuscation technique used by malware, including the AMOS stealer dropper delivered via malicious OpenClaw skills, to hide the initial payload.
This rule detects the execution of a 'git clone' command to download the 'qwibitai/nanoclaw' repository, specifically on devices where a 'node' or 'node.exe' process associated with 'claude' is also observed. This could indicate an adversary installing tools or malicious code on a system potentially related to a 'claude' application or service.
Page 155 of 173