Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.
Detects the creation and configuration of suspicious LaunchAgent and LaunchDaemon plist files on macOS. It identifies files masquerading as legitimate system components (e.g., com.finder.helper, .mainhelper, .agent) or exhibiting common patterns of persistent agent names (random 10+ character names). It also monitors for the use of 'launchctl load' to activate these suspicious configuration files.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects correlated SMOKE#SCREEN activity where a victim host is served a fake Zoom/Flash update lure, an HTTP response containing a JavaScript auto-download trigger, and a Dropbox-hosted payload link, all within the same hourly window.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects execution of a Bun binary from a temporary, download-staging or node_modules path
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
This rule detects potentially malicious activity associated with known supply chain compromise indicators in npm packages (such as Keyv and associated malicious scripts). It flags the execution of specific suspicious files (e.g., 'setup.mjs', 'Math_Symbol.js') or the use of specific versions of common packages known to be associated with recent supply chain attacks, when executed via npm or node.js runtime.
Device Name Search
Cortex XDR
This rule performs a telemetry data retrieval query for a specific agent hostname. It outputs detailed fields related to network connections and process executions (including command lines, user context, and process image names) from the XDR dataset for auditing or investigative purposes.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
Detects the macOS security CLI dumping the Claude Code OAuth credential item from Keychain (find-generic-password -w targeting 'Claude Code-credentials') by a process other than Claude Code itself, indicating credential theft targeting the coding agent's stored token.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
Detects a Node or Bun process writing to Claude Code or VS Code autostart configuration. The
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
keyv/cacheable campaign plants a SessionStart hook in .claude/settings.json and a folderOpen
task in .vscode/tasks.json inside the trojanised source repository. Both execute the stage-1
loader when a developer or an AI coding agent opens the cloned repo, with no npm install
required - so lockfile pinning and registry blocking do not cover this path.
Note: this is the highest-value rule in the set for the agentic AI estate. It is also the one
most likely to need tuning, since tasks.json is legitimately written by many tools.
Detects the deletion of files or archives associated with the SHub Stealer malware (specifically /tmp/shub_ directories or /tmp/out.zip) immediately following staging or exfiltration activity within the same process lineage, which is characteristic of anti-forensic cleanup behaviors.
This rule detects potential malware sandbox/virtualization evasion behavior on macOS. It identifies processes that execute 'system_profiler' with hardware-identifying keywords (e.g., QEMU, VMware, KVM) and correlates this with either immediate process self-termination within 5 seconds or the presence of a 'cis_blocked' signal, which is indicative of a kill-switch mechanism often used by malicious actors to avoid analysis.
Page 78 of 174