Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects JWR phishing framework client engine script via known SHA256 hashes (standalone high-confidence), or the co-occurrence of anti-debug check, staging path structure, and Simplified Chinese operator status strings
Detects JWR phishing kit's fake loading progress-bar overlay (p-bar/_pbar with a maximal z-index) used to mask the hidden iframe's C2 negotiation while building victim trust.
Detects the JWR phishing kit's JwrControlInstruction mechanism relaying operator commands to the victim browser across branded login, OTP/2FA capture, and card-retry page flows.
This rule detects the use of 'osascript' on macOS to generate a fake credential prompt dialog. It specifically looks for AppleScript commands containing keywords such as 'display dialog', 'password', and either 'with hidden answer' or 'Enter your password'. This behavior is characteristic of an adversary attempting to phish user credentials by presenting a legitimate-looking prompt.
This rule identifies network connections using deprecated, insecure TLS versions (TLS 1.0, 1.1) or weak cipher suites (RC4, 3DES, NULL). The use of these legacy cryptographic protocols is a security risk, as they are vulnerable to various attacks like man-in-the-middle, and may indicate misconfigured servers, legacy infrastructure, or attempts by an adversary to downgrade encryption to facilitate traffic interception or inspection.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects use of codesign to apply an ad-hoc signature to a hidden binary in /tmp, allowing it to execute on modern macOS without a valid developer certificate, typically performed immediately after quarantine removal as part of a Gatekeeper bypass chain.
Detects Cortex-managed endpoints that are currently in a disconnected state and are cross-referenced against an inventory of critical or sensitive assets. This rule highlights potential gaps in security monitoring and visibility for high-value systems.
This rule analyzes recent agent telemetry to identify and summarize the distribution of local agent vendors present in the environment over a 30-day lookback period. It extracts vendor information from agent metadata and provides a frequency count to assist in auditing deployed infrastructure agents.
This rule detects potentially malicious command execution (RCE) originating from AI orchestration platforms and development runtimes (such as Ollama, LangChain, AutoGen, CrewAI, n8n, Node.js, and Python). It flags instances where these processes spawn command shells (cmd.exe, powershell.exe, bash, sh) and execute suspicious command-line patterns indicative of code injection or command execution (e.g., eval(), exec(), subprocess, child_process). The rule uses a threshold of 3 or more occurrences in a 15-minute window per device and process to reduce noise.
Detects command-line activity indicating an attempt to extract generic passwords from Google Chrome or Brave browser credential storage, often associated with tools that access the 'Safe Storage' or similar password databases.
This rule detects the installation of a new VS Code extension occurring in close temporal proximity to network communication with the official VS Code marketplace or unpkg domains. This pattern is designed to surface potential supply chain compromises where malicious extensions may be deployed to developers' machines.
Detects attempts to clear or manipulate the shell command history (e.g., bash) using specific commands often utilized by attackers to conceal their activities. The detection monitors for commands such as deleting specific history entries, redirecting history output to /dev/null, or using escape sequences to clear the terminal buffer.
Detects the NaviTheClown ARM64 Go PoC binary exploiting the screensharingd Frame Length pre-auth bug to download arbitrary files as root
Detects the macOS security CLI dumping the Claude Code OAuth credential item from Keychain (find-generic-password -w targeting 'Claude Code-credentials') by a process other than Claude Code itself, indicating credential theft targeting the coding agent's stored token.
No description available.
This rule identifies network connections using deprecated, insecure TLS versions (TLS 1.0, 1.1) or weak cipher suites (RC4, 3DES, NULL). The use of these legacy cryptographic protocols is a security risk, as they are vulnerable to various attacks like man-in-the-middle, and may indicate misconfigured servers, legacy infrastructure, or attempts by an adversary to downgrade encryption to facilitate traffic interception or inspection.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
This rule extracts and audits inventory information from local agents, including vendor, device name, account context, and associated process information. It is designed to provide visibility into the state and configuration of installed local agents within the environment.
KQL Query
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Page 74 of 174