Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,628 detections
Filters
Last updated
All Time
Detection languages
1,752
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,490
1,153
779
528
515
Platforms
39,937
7,246
6,535
3,864
3,628
Products / Services
802
512
432
340
298
MITRE Techniques
1,179
573
523
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the creation of files associated with NPM packages compromised in the "Sha1-Hulud: The Second Coming" campaign. This is a broad query intended for hunting and requires manual verification of package versions.
Detects process execution patterns associated with the "Sha1-Hulud: The Second Coming" NPM supply chain attack. This includes the silent installation of the 'bun' runtime during an 'npm install' and a destructive file shredding command. The rule filters out legitimate manual installations by developers by checking the initiating parent process.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl downloading a file, making it executable with chmod, and executing it in the background, common in FlexibleFerret malware delivery on macOS systems.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Detects extraction of FlexibleFerret malware payload archive to the CDrivers directory on macOS systems.
Detects creation of FlexibleFerret persistence mechanism via LaunchAgent plist in macOS.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Detects execution of ad-hoc signed applications from suspicious locations, used by FlexibleFerret credential harvesting.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Detects command line creation or loading of suspicious LaunchAgent plists related to FlexibleFerret malware on macOS.
Detects execution of MediaPatcher.app decoy application used for credential harvesting.
Detects attempts to use system dialog prompts to capture user credentials
Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.
RMM Tool Hunting
This rule detects the creation or modification of files within specific macOS directories associated with LoginWindow hooks and Authorization Plugins. These locations are commonly abused by adversaries to establish persistence or elevate privileges by injecting malicious code that executes during the login process. The rule specifically looks for file events in '/Library/Security/SecurityAgentPlugins/', '/System/Library/CoreServices/SecurityAgentPlugins/', '/Library/Security/SecurityAgentPlugins.bundle', or any file activity within a 'loginwindow' path. It excludes activities initiated by legitimate installers and software updaters to reduce false positives. Additionally, it filters for files with low global prevalence, indicating potentially suspicious or custom binaries.
Detects the collection and staging of sensitive user data, such as credentials from keychains, browser profiles, and cryptocurrency wallets, by compressing them into an archive. This behavior is a key component of the DigitStealer infostealer's data theft process.
Detects the in-memory execution of AppleScript or JXA payloads via osascript, a technique used by the DigitStealer malware to download and run malicious code while evading file-based detections.
Page 160 of 173