Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of Node.js processes launched by VS Code (via task runner) that reference known Miasma malware persistence paths (e.g., sync.js in hidden NodeJS directories across Windows, Linux, or macOS).
This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.
Detects execution of common shell interpreters initiated by or containing references to ff-agent.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects the execution of a file named 'intro.js' by the Node.js runtime located within a 'node_modules' directory. This pattern is often associated with the execution of suspicious scripts, persistent backdoors, or malicious packages that attempt to masquerade as standard dependencies.
This rule monitors for direct execution of Node.js binaries (node.exe or node) where the target script or binary is located within a 'node_modules' directory. By excluding standard file extensions (.js, .mjs, .cjs, .json) and common npm installation command lines, the rule aims to identify potentially malicious or non-standard binaries being executed in a context often used by adversaries for persistence or lateral movement within software dependency environments.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects unauthorized attempts to modify or interact with the macOS Transparency, Consent, and Control (TCC) database. This includes direct file system modifications by non-system processes, sqlite-based manipulation of the TCC database, or the usage of 'tccutil' to reset permissions. These behaviors are often indicative of malware attempting to silently elevate privileges or grant itself Full Disk Access to sensitive user data.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
Detects the execution of processes originating from the /private/tmp/.CrashReporter directory on macOS systems. This path is often used by adversaries to store or execute malicious binaries in a hidden, temporary location to evade detection.
Detects the execution of processes where the image name or path contains the string 'werkbit'. This is often associated with the execution of potentially malicious or unauthorized tools.
Detects instances where a process creates, renames, or copies a file into the /Library/Caches/ directory where the resulting file's SHA256 hash matches the SHA256 hash of the initiating process. This behavior suggests a binary or script is creating a copy of itself within a writable system cache directory, a common technique for establishing persistence or running code from a less conspicuous location.
Detects the execution of a process named 'Werkbit' or containing 'Werkbit' in its command line that is associated with 'com.apple.crashreporter' but is located outside the standard '/Applications/' directory on macOS. This behavior may indicate an attempt to masquerade or execute unauthorized code disguised as a crash reporting process.
Detects the use of the macOS 'codesign' utility with command-line flags that suggest an attempt to sign a binary with an empty or improperly formatted identity string. This pattern is often used to quickly sign binaries with an ad-hoc signature to bypass security restrictions or for malicious purposes.
This rule detects network connections to a suspicious domain associated with the 'Maccy' application, as well as file and process activity involving files named 'Maccy' that interact with the same suspicious domain. This is indicative of potential unauthorized application execution or malicious activity masquerading as the Maccy utility.
Detects a Node.js process termination followed by a quick respawn of a new Node.js process by the same parent process. This pattern suggests a watchdog persistence mechanism where the parent process monitors the child, automatically restarting it if it is terminated, consistent with behaviors observed in malware such as Void Dokkaebi.
Detects the use of 'osascript' to execute AppleScript-based dialog boxes designed to trick users into providing credentials or mimicking system administration prompts. These scripts use labels often associated with fake security or permission requests to harvest passwords.
Detects the execution of application bundles that mimic legitimate macOS system applications (Finder or Software Update) but originate from non-standard system paths. This behavior is indicative of masquerading techniques used by malware, such as the PamStealer, to execute hidden or unauthorized processes while appearing legitimate.
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
Page 88 of 174