Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
460 detections
Filters
Last updated
All Time
Detection languages
143
106
71
62
54
Contributors
166
120
68
47
15
Categories
215
214
77
73
63
Platforms
341
222
216
18
14
Products / Services
10,665
9,758
6,693
4,421
3,749
460
MITRE Techniques
145
117
82
74
64
CVEs
6
5
5
5
5
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
Detects the spawning of shells (bash, sh) or utility processes (npx) as child processes of Amazon Q or VS Code extension host components. This activity is indicative of exploitation attempts involving malicious Model Context Protocol (MCP) server configurations within workspace environments, as identified by CVE-2026-12957.
Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Detects process command lines that contain patterns indicative of obfuscated payload execution, specifically the combination of 'eval', 'base64', and '-d'. This technique is frequently used by adversaries to decode and execute memory-resident stages without dropping secondary payloads to disk.
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Detects modifications to the VSCode tasks.json configuration file by processes other than the VSCode editor itself. This activity can indicate an attempt to establish persistence or execute malicious code, as seen with malware like Miasma which alters this file to run malicious code during local builds.
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
Detects command line activity indicative of probing endpoint detection and response (EDR) software directories such as CrowdStrike, Falcon, Carbon Black, and SentinelOne. The Miasma malware probes these exact paths to fingerprint host defenses before executing its credential theft module.
This rule detects the creation or modification of the '.vscode/extensions.json' file. This file is critical for managing extensions within Visual Studio Code environments. Attackers can exploit modifications to this file, as demonstrated in recent zero-day attacks, to introduce malicious extensions, potentially leading to code execution or other forms of compromise within a developer's environment. The detection focuses on file system events (creation and modification) targeting this specific configuration file.
Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
Page 16 of 22