Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects a shell/interpreter process spawned by a VS Code / VS Code-Insiders editor process that references CI marker environment variable names (GITHUB_, GITHUB_REPOSITORY, GITLAB_CI_, CI_PROJECT_PATH), matching how malicious Open VSX 'evil twin' extensions harvested CI/CD environment variables from GitHub, GitLab, and Azure DevOps runners.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects the malicious signed 64-bit ARM Mach-O ngrok binary distributed as a.out, flagged by multiple AV engines as adware/hacktool ngrok
Detects cloudflared launched with 'tunnel --url' against localhost or api.trycloudflare.com without managed-tunnel authentication flags, indicating deployment of an ad-hoc Cloudflare Quick Tunnel exposing a local service to the internet.
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
This rule detects the execution or presence of known malicious JavaScript loader files identified as part of a banking-lure phishing campaign by matching their SHA256 file hashes.
Detects dropper/staging scripts that curl-fetch a second-stage Mach-O payload to /tmp/helper or /tmp/update, chmod +x it immediately afterward in the same command sequence, ad-hoc/unsigned sign it, and strip quarantine attributes, while excluding scripts that verify a legitimate Developer ID signature
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects a Node or Bun process reaching the cloud instance metadata service. The keyv/cacheable
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
This rule analyzes recent agent telemetry to identify and summarize the distribution of local agent vendors present in the environment over a 30-day lookback period. It extracts vendor information from agent metadata and provides a frequency count to assist in auditing deployed infrastructure agents.
This rule detects potential credential theft activity where a process spawning a command-line interpreter (bash, sh, zsh) using 'curl' simultaneously accesses sensitive browser configuration or credential directories on MacOS, such as Chrome, Firefox, or Safari application support paths. This pattern is indicative of an adversary attempting to exfiltrate browser-stored secrets.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
Detects outbound network connections and DNS queries to a maintained list of known UNC6671 extortion-related domain names. The rule utilizes a temporal 'recency' window (aged IOCs) to filter out stale indicators, mitigating false positives caused by sinkholed or reassigned infrastructure.
This rule detects the potential replacement of legitimate cryptocurrency wallet applications (Ledger, Trezor, Exodus) by monitoring for the download of zip archives from suspicious paths containing 'zxc' using curl, followed by the creation or modification of files within known wallet application directories. This activity is indicative of a trojanized application delivery mechanism, often associated with info-stealer campaigns.
This rule detects macOS infostealer activity, such as AMOS, MacSync, or SHub, by identifying suspicious, correlated access to sensitive credential stores including the macOS Keychain, web browser credential databases (Chrome), SSH keys, and cryptocurrency wallet configuration files. It uses a combination of path/command-line strings and generic indicators of credential harvesting behavior.
Detects creation of the stage-2 payload files distributed with the compromised keyv and
cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written
to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded
Bun runtime. These filenames are specific to the campaign and should be treated as high
fidelity indicators.
cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written
to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded
Bun runtime. These filenames are specific to the campaign and should be treated as high
fidelity indicators.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects a decrypted Keychain dump (security dump-keychain -d) spawned from a Cursor/coding-agent process with output filtered for Linear, MCP, or OAuth-related strings, indicating targeted credential theft of MCP/Linear integration tokens.
Page 77 of 174