Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects short-lived execution of the compiled AppleScript loader from /tmp/p.app, correlated with its rapid creation-then-deletion pattern, the observable proxy for XCSSET's dual-key-encrypted loader architecture.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
This rule monitors process command line arguments for strings containing 'maliciousdomain.com'. This pattern is indicative of a process interacting with a known malicious domain, commonly associated with phishing campaigns or initial access attempts where malicious links or payloads are invoked via command-line tools.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects XCSSET's 'stats' anti-VM module generating a hardware/CPU-based VM verdict string or exfiltrating the verdict to C2 to gate further module delivery.
Detects a Perl process acquiring and holding an exclusive file lock on the XProtect signature database (XPdb) to prevent macOS security-signature updates from being written to disk.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects a parent process spawning at least two distinct macOS system reconnaissance utilities (sw_vers -productVersion, system_profiler SPHardwareDataType, ioreg -rd1 IOPlatformExpertDevice) within a 5-minute window, consistent with CountLoader recon behavior delivered via the DOUBLECUP ClickFix loader.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects unauthorized processes attempting to access sensitive browser files containing credentials (e.g., 'Login Data', 'logins.json') and cookies (e.g., 'store.json.mozlz4', 'Browser_Cookies.json'). This behavior is commonly associated with credential harvesting malware such as TOKYOCORE, which seeks to steal stored browser secrets before they can be encrypted or for immediate use in session hijacking.
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
Detects XCSSET's loader binary staged to /tmp/r and an AppleScript wrapper compiled on the fly at /tmp/p.app, both created and deleted within a short window to erase forensic footprint.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.
Page 82 of 174