Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,941
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the creation or modification of an unsigned Spotlight importer (.mdimporter) bundle within a user's Library/Spotlight directory on macOS. This activity is indicative of the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker leverages a malicious, unsigned importer to gain unauthorized access to TCC-protected data via the mds/mdworker processes.
Detects the creation of a Spotlight importer bundle (.mdimporter) in a user's Library directory. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker places a malicious importer to be executed with elevated privileges by the mds_stores process, allowing unauthorized access to TCC-protected data.
A USB device with Vendor ID 0E90 is associated with vendor WiebeTech (a.k.a "CRU"), which is known to manufacture "mouse jigglers." These hardware devices can be used to prevent a computer from automatically locking the screen or going to sleep. Illegitimate use can range from policy violation to nefarious activity like remote desktop abuse.
The following EQL query can be used to hunt for XMRIG executions within your environment.
Description: Detects the execution of a signed macOS application that subsequently spawns a script interpreter like osascript, sh, or bash. This behavior is uncommon for many legitimate GUI applications but is a known TTP for macOS malware like Odyssey Stealer, which uses signed droppers to execute malicious scripts for credential theft, persistence, and payload delivery.
Detects the installation of specific malicious npm packages associated with the North Korean "Contagious Interview" campaign. These packages are known to deliver the XORIndex malware loader.
Detects the creation of hidden configuration files or a LaunchDaemon plist file used by the Odyssey Stealer malware to establish persistence on a compromised macOS system.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Detects the persistence mechanism and command and control (C2) communication used by the Atomic macOS Stealer (AMOS) backdoor. This includes the creation of a LaunchDaemon, download of a helper binary, and C2 task polling.
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
Detects macOS launchd entries that are not part of the standard Apple system, which could indicate persistence mechanisms used by malware; it is an invalid rule due to a future date.
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Discord Invite Hijacking Detection
KQL Query from file: Detect CVE-2025-27607 (CVSS 8.8)
Detects the execution of the "chflags" utility with the "hidden" flag on macOS. When this flag is set on a file or directory, it becomes invisible to default file listing commands and graphical file browsers, a common technique used by adversaries for defense evasion.
Detects the execution of the `hdiutil` utility on macOS to mount disk images. This activity can be associated with malware delivery, as adversaries often use disk images (.dmg files) to distribute malicious payloads. Monitoring this utility can help identify suspicious attempts to introduce or execute malware on a system.
Page 166 of 174