Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects screenshot files being created in temp directories by Node.js processes. OtterCookie captures multi-monitor screenshots and stores them as JPEG files before exfiltration.
Detects the creation of files associated with NPM packages compromised in the "Sha1-Hulud: The Second Coming" campaign. This is a broad query intended for hunting and requires manual verification of package versions.
Detects process execution patterns associated with the "Sha1-Hulud: The Second Coming" NPM supply chain attack. This includes the silent installation of the 'bun' runtime during an 'npm install' and a destructive file shredding command. The rule filters out legitimate manual installations by developers by checking the initiating parent process.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl downloading a file, making it executable with chmod, and executing it in the background, common in FlexibleFerret malware delivery on macOS systems.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Detects extraction of FlexibleFerret malware payload archive to the CDrivers directory on macOS systems.
Detects creation of FlexibleFerret persistence mechanism via LaunchAgent plist in macOS.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Detects execution of ad-hoc signed applications from suspicious locations, used by FlexibleFerret credential harvesting.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Detects command line creation or loading of suspicious LaunchAgent plists related to FlexibleFerret malware on macOS.
Detects execution of MediaPatcher.app decoy application used for credential harvesting.
Detects attempts to use system dialog prompts to capture user credentials
Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.
RMM Tool Hunting
This rule detects the creation or modification of files within specific macOS directories associated with LoginWindow hooks and Authorization Plugins. These locations are commonly abused by adversaries to establish persistence or elevate privileges by injecting malicious code that executes during the login process. The rule specifically looks for file events in '/Library/Security/SecurityAgentPlugins/', '/System/Library/CoreServices/SecurityAgentPlugins/', '/Library/Security/SecurityAgentPlugins.bundle', or any file activity within a 'loginwindow' path. It excludes activities initiated by legitimate installers and software updaters to reduce false positives. Additionally, it filters for files with low global prevalence, indicating potentially suspicious or custom binaries.
Page 161 of 174