Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects potential credential theft attempts targeting macOS Keychain. It identifies the use of the 'security' utility with commands like 'dump-keychain' or 'find-generic-password' and monitors for unauthorized processes accessing files within the 'Library/Keychains' directory.
This rule detects execution of macOS processes that contain specific strings associated with cryptocurrency wallet-draining malware (e.g., 'DRAIN_PCT', 'DRAIN_FUNCTION'). It monitors process creation command-line arguments to identify attempts by malicious software to execute functions intended to empty victim crypto wallets.
Detects PlistBuddy setting a StartInterval key on a com.*watchdog.plist LaunchAgent from a zsh parent process, indicating a coding-agent-driven persistence mechanism used to relaunch a reverse-tunnel watchdog after reboot or process termination.
Detects a decrypted Keychain dump (security dump-keychain -d) spawned from a Cursor/coding-agent process with output filtered for Linear, MCP, or OAuth-related strings, indicating targeted credential theft of MCP/Linear integration tokens.
This rule detects instances where a process that is not a recognized web browser attempts to access sensitive files associated with browser credential stores, such as Login Data, Cookies, and web browser state files. Such activity is commonly associated with infostealer malware, which attempts to exfiltrate saved passwords, session cookies, and autofill information.
Detects execution of a 'setup.mjs' preinstall lifecycle hook, the stage-1 loader used in the
4 August 2026 compromise of the keyv and cacheable npm namespaces. The trojanised package.json
adds "preinstall": "node setup.mjs" while leaving dist/ byte-identical to the last clean
release, so the only execution-time signal is the hook itself. The loader downloads a
standalone Bun runtime and executes an obfuscated second stage (Math_Symbol.js).
4 August 2026 compromise of the keyv and cacheable npm namespaces. The trojanised package.json
adds "preinstall": "node setup.mjs" while leaving dist/ byte-identical to the last clean
release, so the only execution-time signal is the hook itself. The loader downloads a
standalone Bun runtime and executes an obfuscated second stage (Math_Symbol.js).
Detects a rapid multi-stage infection chain on macOS, typically associated with the ClickFix campaign. The rule monitors for a sequence of process events starting from a shell, followed by a curl-based download, data decoding via base64 or openssl, execution of the decoded content via shell/python/perl, and finally persistence mechanisms using launchctl or osascript, all occurring within 28 seconds.
Detects the execution of malicious 'node.exe' processes that invoke 'setup.mjs' or 'math_init.js' scripts from within .vscode or .claude configuration directories. This pattern is characteristic of the ChainDrop/Shai-Hulud npm supply chain worm, which leverages VS Code tasks or Claude Code session hooks to achieve persistent execution of dropper scripts without triggering standard npm installation flows.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects a Claude Code shell-snapshot source invocation followed by additional chained commands (e.g. curl, jq, eval) rather than a clean startup guard, indicating anomalous use of the coding agent's session-init mechanism to smuggle in follow-on actions.
Detects curl reusing a captured cookie jar (-b /tmp/lhr_c) against a known tunnel domain, indicating session-cookie replay to hijack an authenticated session exposed via a reverse tunnel.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
This rule detects suspicious activity involving the modification of file attributes on macOS, specifically targeting the removal of the 'com.apple.quarantine' extended attribute and the manipulation of files associated with 'com.apple.trustd'. Such actions are indicative of an adversary attempting to bypass Gatekeeper security controls or execute masqueraded payloads by stripping quarantine flags or modifying execution permissions.
No description available.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
This rule extracts and audits inventory information from local agents, including vendor, device name, account context, and associated process information. It is designed to provide visibility into the state and configuration of installed local agents within the environment.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
This rule detects potentially malicious activity associated with known supply chain compromise indicators in npm packages (such as Keyv and associated malicious scripts). It flags the execution of specific suspicious files (e.g., 'setup.mjs', 'Math_Symbol.js') or the use of specific versions of common packages known to be associated with recent supply chain attacks, when executed via npm or node.js runtime.
Page 76 of 174