Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
An adversary may be leveraging the compromised Visual Studio Code extension nrwl.angular-console-18.95.0 to gain initial access, execute malicious code, or compromise developer environments through trusted VSCode extension installations.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Suspicious Script and Utility Execution
Cortex XDR
This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Generic rule content from file: Potential OpenClaw | Clawdbot | Moltbot installation
Matches known Larva-24009 (HeptaX) malicious file hashes
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects unauthorized credential validation attempts on macOS using the 'dscl -authonly' command. The rule identifies instances where suspicious interpreter processes (like bash, zsh, python, or curl) or their derivatives attempt to validate credentials via the Directory Service Command Line tool, while excluding known legitimate system and management processes.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
Detects anomalous native code execution behavior within Firefox or Tor Browser processes by correlating memory protection changes (e.g., VirtualProtect/mprotect) with subsequent suspicious execution events occurring within a two-minute window, indicative of WebAssembly-based exploit chains.
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects command-line execution associated with WhatsApp API contact synchronization, specifically looking for 'WPP.contact.getAllContacts' or 'WPP.contact.list' commands. This pattern may indicate automated or unauthorized scraping of contact lists via a messaging interface.
Detects creation of a new com.<random-string>.plist file under ~/Library/LaunchAgents or /Library/LaunchAgents, followed by launchctl load/bootstrap referencing LaunchAgents, or an osascript-to-bash heredoc chain writing a plist into LaunchAgents, consistent with EtherHiding's macOS Launch Agent persistence mechanism.
Detects outbound network traffic to the 'logfriend[.]com' domain, specifically to endpoints used by the Forg365 'ForgCookie' browser extension. This extension is known to facilitate the automated refreshing of Microsoft SSO cookies, potentially enabling persistent session hijacking and bypassing MFA.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.
Page 81 of 174