Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects modifications to AI assistant configuration files by suspicious processes like package managers (npm, yarn) or shell interpreters (bash, powershell). This activity is indicative of a supply chain attack, specifically the SANDWORM_MODE campaign, where an attacker injects a rogue Model Context Protocol (MCP) server entry to hijack AI tools. This enables automated source code and secret theft via prompt injection.
Detects curl or wget download followed by chmod and execution, consistent with staged malware delivery used by malicious OpenClaw skills distributing AMOS.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
This rule detects network connections to known cryptocurrency mining pools or processes associated with cryptocurrency mining. It identifies suspicious activity based on remote URLs, process names, and remote ports commonly used by miners.
Detects Base64 decoded content being executed via a shell on macOS, consistent with malicious OpenClaw skill style obfuscated command execution.
Detects the Claude CLI or Claude Code spawning suspicious child processes such as shells or network utilities. This behavior indicates exploitation of malicious hooks or MCP server configurations executing arbitrary commands, as seen in CVE-2025-59536 and CVE-2026-21852.
Detects a node.js process spawning another node.js process to evaluate a script from the command line or stdin. This is a key technique used by malware, as referenced in the Jamf Threat Labs report on DPRK-linked actors, to execute additional payloads received from a C2 server persistently.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
Detects DKnife text markers and config file names referenced by Cisco Talos (dkimsi tag, default IMSI, credential tag, and common DKnife config artefact names).
Hunts for unwarranted hardware additions through USB device connections in macOS Unified Logs. In an environment where USB devices are not permitted.
In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects the execution of multiple common network discovery commands within a short time frame. This behavior can indicate reconnaissance activities aimed at understanding network topology, identifying active hosts, and discovering network services.
Detects the execution of osascript to display a deceptive dialog box mimicking 'System Preferences' to harvest user passwords. This technique was observed being used by the Atomic Stealer (AMOS) malware.
This rule detects network connections or DNS queries to a list of domains identified as phishing campaign infrastructure. These domains are associated with a 'Signal Phishing Campaign' and are likely used for malicious purposes such as credential harvesting or malware distribution. The rule checks for these domains in `RemoteUrl` or `DestinationHost` fields across various network-related logs.
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
Page 157 of 174