Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule monitors DeviceFileEvents to detect the installation of a known malicious browser extension, 'VPN Go: Free VPN'. By matching file activity against the extension's unique ID, this detection helps identify potential browser-based threats, such as information stealer functionality or persistent backdoors installed via malicious extensions.
Detects macOS Mach-O binaries containing AES-GCM cipher references combined with /tmp staging paths, consistent with CrashStealer encrypting stolen data locally with AES-GCM before staging it in /tmp for exfiltration
Detects execution of the macOS 'dscl' utility using the '-authonly' flag. This command is used to authenticate a user against a directory service without creating a session, which can be indicative of brute-force attempts or credential validation by unauthorized processes.
Detects processes attempting to read sensitive browser storage files, specifically 'Login Data' (passwords) and 'Cookies', located within common browser paths for Chrome, Firefox, and Safari on macOS or similar environments using Application Support/Library folders.
Detects the use of the macOS 'codesign' utility to sign binaries using a self-signed or empty identity certificate. This technique is often used by adversaries to bypass Gatekeeper security controls or to make unsigned malicious binaries appear legitimate.
Detects the installation or referencing of the malicious @injectivelabs/sdk-ts package version 1.20.21. This specific version was identified as containing a credential-stealing backdoor disguised within telemetry code.
This rule detects processes command lines containing keywords associated with anti-debugging techniques, such as 'PT_DENY_ATTACH' (a common macOS ptrace flag used to prevent debugger attachment) or generic 'ptrace' and 'sysctl' system calls often leveraged by malware for process introspection or debugger evasion.
Detects execution of security utility commands on macOS intended to unlock a login keychain by providing a password via command line arguments. This behavior is indicative of an attempt to programmatically access stored credentials, which may be a precursor to credential theft.
Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
This YARA rule detects specific macOS malware components associated with the threat actor Citrine Sleet (AppleJeus) by matching static dylib and entitlement hashes. It targets identified malicious payloads including UpdateAgent, SimpleTea (POOLRAT), and CrashReporter to track the group's tooling.
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects repeated execution of 'defaults read' or 'du -sh' commands within a one-hour window. These commands are commonly used for system information and file directory discovery, which may indicate reconnaissance activity by an attacker.
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Page 86 of 174