Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Mimikatz payload has been executed on a system as one-liner likely to output to a file for collection
Detects the creation of malicious disk images (.dmg) or a dropper file (.msi) associated with the DigitStealer macOS infostealer campaign.
Detects the execution of `sysctl` commands querying for specific Apple Silicon M2+ hardware features. This behavior is used by the DigitStealer malware for anti-analysis purposes to evade detection and target specific hardware.
Detects the macOS Script Editor (`Script Editor.app`) launching child processes or initiating network connections. This behavior can indicate the execution of a malicious AppleScript used to download secondary payloads or execute arbitrary commands, as seen in campaigns delivering stealers like MacSync and Odyssey.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
Detects possible malicious execution of JXA in-memory via OSAScript
Detects potential suspicious run-only executions compiled using OSACompile
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
Detects the creation of a Keras model file (.keras) that contains suspicious file paths or URLs. This may indicate an attempt to exploit CVE-2025-12058 for local file inclusion or server-side request forgery (SSRF).
Detects the execution of the Ligolo-ng tunneling tool, which is used by the Silent Lynx APT group for command and control and network pivoting.
This query is oriented to identify and classify browser extensions by group and risk severity based on a well-known list of browser extension.
This rule detects when a user is added to the local 'admin' group on a macOS system using either the `dscl` or `dseditgroup` command-line utilities. It specifically looks for command-line arguments indicative of adding a user to the 'admin' group. There is a whitelist for legitimate MDM solutions like 'jamfmanager' to reduce false positives.
Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.
This rule detects a sequence of events indicative of a potential macOS ClickFix attack. It looks for a base64 encoded command executed by 'bash' or 'zsh', immediately followed (within 10 seconds) by a 'curl' command that initiates a network connection to a URL. The rule specifically excludes a whitelisted curl command to reduce false positives. The correlation of base64 execution, a subsequent curl command, and a successful network connection to the domain extracted from the curl command suggests an attempt to download and execute malicious content, possibly after decoding it.
Detects potential exploitation of the TARmageddon vulnerability (CVE-2025-62518) by identifying multiple writes to sensitive configuration files by the same process in a short time frame. This behavior can indicate a file overwrite attack where a malicious TAR archive smuggles and extracts a secondary file to hijack build processes or application configurations.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects the interaction with macOS XPC services such as 'nsurlstoraged' and 'CoreSpotlightService' via 'xpcproxy'. This technique is used by malware like AMOS and Odyssey Stealer to blend malicious activity with legitimate system processes for stealth and persistence.
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection to a non-private IP address on port 7712. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
Page 162 of 174