Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects a high volume of network connections from a browser process to a high port on the local host (127.0.0.1 or ::1). This pattern can indicate a malicious website attempting to brute-force credentials for a local service, such as the OpenClaw AI agent, by abusing the browser's permission to establish WebSocket connections to localhost. The vulnerable service may not rate-limit these local connections, allowing for rapid password guessing.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
This rule detects the execution of a process that attempts to build an executable using 'zig build-exe' and subsequently initiates a process with a command line containing 'https://github.com/nullclaw/nullclaw.git'. This could indicate an adversary building a malicious executable on a host and then attempting to download or interact with a malicious GitHub repository, potentially for further stages of an attack.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Detects broad filesystem searches using native OS commands ('dir' on Windows, 'find' on Linux/macOS) for files containing sensitive developer information like private keys, mnemonic phrases, and configuration files. This TTP is used by modules 5 and 6 of the StegaBin toolkit.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
This query identifies devices that have specific software installed, enriching this information with device details like OS, exposure level, and internet-facing status. This is useful for asset inventory and identifying potentially exposed endpoints, especially when vulnerability information might not be immediately available through other means. The current rule is configured to detect "Acronis Cyber Protect" software.
This rule helps identify suspicious repository files that may try to run code automatically when a developer opens a project in an editor or when a build starts. It searches for the exact wording used by the editor to auto run tasks when a folder is opened, and it also looks for a set of web addresses published in public reporting that were used to deliver additional code. A match does not always mean the repository is malicious, but it does mean the file deserves careful review before it is executed on a developer machine. If you see a hit, confirm the repository source, check for unexpected scripts or obfuscated code, and review recent network traffic for connections to the listed staging sites. If the repository is not clearly trusted, isolate the environment, remove the project from production developer workstations, and rotate any secrets that may have been available. This rule is meant to provide a clear and understandable safety check for teams that regularly clone and run new code.
Detects the execution of a shell command that decodes a base64 string and pipes the output directly into another shell for execution. This is a common obfuscation technique used by malware, including the AMOS stealer dropper delivered via malicious OpenClaw skills, to hide the initial payload.
This rule detects the execution of a 'git clone' command to download the 'qwibitai/nanoclaw' repository, specifically on devices where a 'node' or 'node.exe' process associated with 'claude' is also observed. This could indicate an adversary installing tools or malicious code on a system potentially related to a 'claude' application or service.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.
Detects processes attempting to read or copy the Apple Keychain database file (login.keychain-db). Unauthorized access to this file is a strong indicator of credential theft activity, as seen with stealers like AMOS.
Detects xattr quarantine removal on a file in a writable location, often used before executing downloaded malware such as AMOS delivered via malicious skills.
Detects the execution of 'osascript' to display a deceptive system dialog box mimicking a 'System Preferences' password prompt. This technique is used by malware like the Atomic macOS Stealer (AMOS) to trick users into entering their administrative password for credential theft.
Detects outbound network traffic to a known Atomic macOS Stealer (AMOS) command and control (C2) server. This activity is associated with the exfiltration of stolen data, such as credentials, browser data, and system information, compressed into a ZIP archive.
Page 156 of 174