Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects XCSSET's 'stats' anti-VM module generating a hardware/CPU-based VM verdict string or exfiltrating the verdict to C2 to gate further module delivery.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects a repeated/looped termination pattern against the CloudTelemetryService process, matching XCSSET's continuous loop that blocks security telemetry from reaching Apple.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects a Perl process acquiring and holding an exclusive file lock on the XProtect signature database (XPdb) to prevent macOS security-signature updates from being written to disk.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects the macOS ClickFix dropper chain where curl fetches a disguised Mach-O payload (winapp.bin/ZoomSDK.bin) within a process chain that also shows an osascript decoy dialog or a self-deleting shell script, consistent with BlueNoroff's fake meeting-app installer delivery.
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
Detects scripted use of the macOS 'security find-generic-password' command targeting the Chrome Keychain item from a shell or unsigned temp-directory parent process, consistent with BlueNoroff's post-ClickFix Keychain master-key theft technique.
Detects suspicious execution patterns associated with the SleeperGem supply chain attack, where a compromised Gem install script (git_credential_manager-2.8.3/bin/install) spawns shell or PowerShell commands to trigger secondary malicious scripts like deploy.sh or redirects output to /dev/null.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects a repeated/looped termination pattern against the CloudTelemetryService process, matching XCSSET's continuous loop that blocks security telemetry from reaching Apple.
Detects osascript executing AppleScript containing 'do shell script ... with administrator privileges' to elevate execution, where the osascript process was spawned by a non-shell parent process, consistent with the EtherHiding macOS loader technique.
Detects the keylog_start/keylog_stop C2 command schema with active-window-title capture used by ChonkyChicken's keylogging capability.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects processes accessing files within a user's ~/.ssh directory, excluding standard files like known_hosts and .pub files. This pattern is characteristic of malware attempting to exfiltrate SSH private keys, similar to the behavior observed in the mrmustard stealer.
Page 83 of 174