Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects the interaction with macOS XPC services such as 'nsurlstoraged' and 'CoreSpotlightService' via 'xpcproxy'. This technique is used by malware like AMOS and Odyssey Stealer to blend malicious activity with legitimate system processes for stealth and persistence.
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection to a non-private IP address on port 7712. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
This rule detects attempts to enable the guest account on macOS systems using the `sysadminctl` utility. Adversaries may enable the guest account to establish persistence, evade defenses, or gain initial access by leveraging a default, often less monitored, account.
This rule detects attempts to add a user to the 'admin' group on macOS systems using the `dscl` command-line utility. Specifically, it looks for `dscl` commands that include the `-append` option, target the `/Groups/admin` path, and modify `GroupMembership`. This activity is often associated with privilege escalation or persistence by granting administrative rights to a standard user account.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
Detects attempts to create and add an account to the admin group via the `sysadminctl` utility on macOS. This action can be used for persistence, privilege escalation, or defense evasion by creating a new administrative user.
Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This rule specifically looks for the `TeamViewer_Desktop` process being launched by `TeamViewer_Service` with specific command-line arguments, indicating a remote connection. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
This rule detects macOS malware associated with the North Korean threat actor group CitrineSleet (also known as AppleJeus or UNK_JuiceHead). It specifically identifies binaries that exhibit consistent Dylib and Entitlement usage patterns observed in variants like UpdateAgent, SimpleTea (aka POOLRAT), and CrashReporter. The detection is based on matching specific hashes for the dylib and entitlement sections within Mach-O executable files.
This rule detects the Amos Stealer malware by identifying specific dylib and entitlement hashes within Mach-O files. It targets macOS executables that exhibit these unique characteristics associated with the Amos Stealer.
This rule detects attempts to capture user credentials on macOS by leveraging the `osascript` utility to display system dialog prompts. It specifically looks for `osascript` executions that include commands to 'display dialog' with keywords commonly associated with credential requests, such as 'admin', 'password', 'authenticate', or 'credentials'. This technique can be used by adversaries to present seemingly legitimate pop-ups to trick users into entering their credentials.
Detects the Node Package Manager (npm) or npx spawning child processes commonly used to download remote files. This behavior is often seen in malicious npm packages that use post-install scripts to fetch and execute second-stage payloads, as seen with the AdaptixC2 framework delivery.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
The analytic detects the use of the curl command contacting suspicious remote domains, such as s3.amazonaws.com, which is indicative of Command and Control (C2) activity or downloading further implants. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate the presence of MacOS adware or other malicious software attempting to establish persistence or exfiltrate data. If confirmed malicious, this could allow attackers to maintain control over the compromised system and deploy additional payloads.
Detects the execution of the 'xattr -c' command on a macOS endpoint. This command is used to clear all extended attributes from a file, including the 'com.apple.quarantine' attribute set by Gatekeeper on downloaded files. UNC5142 uses this technique to bypass macOS security prompts before executing downloaded malware like the ATOMIC infostealer.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
This correlation rule identifies multiple risk events associated with the "Living Off The Land" analytic story. It aggregates and correlates events tagged under this story, focusing on systems with a high count of distinct sources (5 or more). The rule aims to detect suspicious behavior involving the use of legitimate tools for malicious purposes, which could lead to code execution, privilege escalation, or persistence within an environment.
Page 163 of 174