Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects the execution of 'node.exe' or 'node' processes that involve specific JavaScript files ('dist/setup.js' or 'dist/intro.js') within the command line arguments or file paths. Such patterns are indicative of potential malicious activity, often associated with the deployment of unauthorized scripts or secondary payloads in a node.js environment.
This rule detects attempts to jailbreak Large Language Models (LLMs) by monitoring event logs and process command lines for indicators of 'Prompt Shields' activity. It specifically identifies when a jailbreak attempt is either detected or blocked by security controls.
Detects potential LLM prompt injection or jailbreak attempts within command line arguments or event log data, such as instructions to override system prompts or masquerade as a specific persona.
Detects instances where a Unix shell (sh, bash, dash, ash) is spawned by or initiated from the 'ff-agent' process. This pattern often indicates malicious script execution or administrative activity associated with the agent's environment, potentially signaling post-exploitation activity or unauthorized command execution.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
This rule monitors network DNS queries for patterns commonly associated with webhook notification services or potential C2 infrastructure. It looks for specifically formatted domains (e.g., 'api.[random]-notifier.[tld]', 'build-notifier' substrings, or custom API subdomains on common cloud-native TLDs) which may indicate the use of webhook services for data exfiltration or adversary command and control.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
Detects process execution where the process path or the initiating process path resides within the '/private/tmp/.CrashReporter' directory. This directory is often used by adversaries to hide malicious binaries or scripts in a location that might appear legitimate but is generally inappropriate for persistence or staging.
Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Detects the creation, modification, or renaming of ZIP archive files prefixed with 'zx_' within the macOS crash reporter cache directory. This behavior may indicate an adversary staging crash report data for potential exfiltration.
Detects a Node.js process spawning a detached child process that executes a script named 'caller.js'. This behavior is consistent with the 'nodemon-sudo' or 'tslint-conf' supply chain attacks, which leverage detached child processes to execute malicious second-stage payloads while suppressing console output, effectively creating a persistent, hidden backdoor.
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
Detects the execution of processes associated with voice manipulation, voice changing, or 'deepfake' software. These tools may be used by adversaries to facilitate social engineering, impersonation, or to bypass voice-based authentication mechanisms.
These YARA rules detect indicators of compromise (IOCs) associated with a campaign where malicious actors compromised developer accounts to distribute malicious Google Chrome extensions. The rules search for a specific set of C2 IP addresses, domains, extension names, and unique extension IDs known to be part of this supply chain attack.
These YARA rules detect encrypted ZIP archive files that contain exactly one file. Specific variations are provided for ZIP files containing a single .vbs or .msc file. This pattern is commonly used in malware distribution via email to bypass static security controls, requiring user interaction to decrypt and execute the payload.
Detects instances of Node.js processes executing command-line instructions related to publishing packages (npm, twine, or cargo). This behavior is characteristic of Miasma malware's 'trySpread' routine, which attempts to propagate the malware by leveraging compromised package repository tokens.
Page 87 of 174