Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
460 detections
Filters
Last updated
All Time
Detection languages
143
106
71
62
54
Contributors
166
120
68
47
15
Categories
215
214
77
73
63
Platforms
341
222
216
18
14
Products / Services
10,670
9,758
6,693
4,421
3,749
460
MITRE Techniques
145
117
82
74
64
CVEs
6
5
5
5
5
Detects unauthorized processes attempting to access sensitive browser files containing credentials (e.g., 'Login Data', 'logins.json') and cookies (e.g., 'store.json.mozlz4', 'Browser_Cookies.json'). This behavior is commonly associated with credential harvesting malware such as TOKYOCORE, which seeks to steal stored browser secrets before they can be encrypted or for immediate use in session hijacking.
Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects TOKYOCORE ransomware via high-confidence identity strings; a single match is sufficient
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Exact SHA256 match against the two known malicious mrmustard 0.7.4 PyPI sdist/wheel artifacts. Uses full-file (0, filesize) SHA256 equality only, not partial or truncated comparison.
Heuristic detection of high-entropy, obfuscated script content consistent with AI-generated (WormGPT-derived) malware formatted specifically to evade AV/EDR detection tooling
MAL AMOS yara x
YARA
This YARA rule detects the Amos Stealer malware on macOS by matching a specific Mach-O dylib hash and entitlement hash, which are consistent markers for samples of this information stealer.
Detects macOS Mach-O binaries containing AES-GCM cipher references combined with /tmp staging paths, consistent with CrashStealer encrypting stolen data locally with AES-GCM before staging it in /tmp for exfiltration
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects attempts to grant world-writable (0666) permissions to the /dev/kvm device node using chmod or setfacl, or unauthorized (non-root) accounts interacting directly with the device. Such configuration changes are associated with the Januscape (CVE-2026-53359) vulnerability, which allows local users to exploit a shadow MMU use-after-free in the kernel to escalate privileges to root or escape into the host from a virtualized environment.
Identifies Linux systems acting as KVM hypervisors that are running kernels vulnerable to CVE-2026-53359 (Januscape), a use-after-free vulnerability in the shadow MMU (arch/x86/kvm/mmu/mmu.c). This vulnerability permits a guest virtual machine to escape into the underlying host environment, potentially compromising the hypervisor and other hosted workloads.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
day3 ProgLangs
YARA
These YARA rules detect the presence of compiled executables written in Rust, Golang, or Nim by matching specific language-related artifacts, such as compiler-generated metadata, runtime library paths, or symbol patterns within Windows PE or Linux ELF binaries.
Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.
Detects the execution of processes containing command-line arguments '-debugport' or '-lport'. These flags are often used to configure remote debugging or listen ports, which can be abused by adversaries for persistence or command and control (C2) communication.
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
Detects the presence, file creation, or execution of known proof-of-concept (PoC) scripts, binaries, and directories associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Page 8 of 22