Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
This rule detects the creation or modification of specific files associated with the SHub v2.0 infostealer on macOS. It looks for a fake 'GoogleUpdate' binary within the '~/Library/Application Support/Google/' directory or a LaunchAgent plist file named 'com.google.keystone.agent.plist' in the 'LaunchAgents/' directory. These file paths are indicative of the SHub stealer's persistence mechanism, which impersonates legitimate Google update components.
This rule detects suspicious Python command-line executions that involve importing the 'requests' library, using 'exec()' for dynamic code execution, and making HTTP/HTTPS requests. This pattern is often observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware
to bypass Transparency, Consent, and Control (TCC) restrictions.
to bypass Transparency, Consent, and Control (TCC) restrictions.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware to bypass Transparency, Consent, and Control (TCC) restrictions.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
Detects logs cleared in MacOS systems
Detects the creation of a 'startup.js' file in specific, non-standard subdirectories used by the Lazarus Group's 'Graphalgo' campaign to stage malicious payloads. These paths mimic legitimate application folders to evade detection.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
This rule detects the execution of 'osascript' on macOS when its parent command line contains 'curl'. This pattern is indicative of a stager piping a curl response directly to osascript, often without writing a script to disk, as described in the ClickFix and MacSync/SHub delivery patterns by Datadog.
Page 158 of 174