Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects Python processes initiated or executed in association with 'langflow'. It flags instances where Python is invoked with command-line arguments containing Base64 decoding patterns or '-c' flags, which are commonly used by attackers to execute obfuscated or staged payloads within a Python environment.
Detects anomalous internal network activity where a single host attempts to connect to multiple unique internal IP addresses across various ports within a short timeframe. This behavior is indicative of lateral movement reconnaissance or port scanning within the internal network.
This rule monitors process command lines for strings associated with sensitive API keys (e.g., OpenAI, Alibaba, Huawei, Tencent, Aliyun) or seed phrases. It triggers an alert when two or more distinct patterns are identified on the same host, indicating potential credential harvesting or discovery activities.
Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects a sequence of actions on macOS where an attacker removes the quarantine extended attribute (com.apple.quarantine) using 'xattr' and subsequently performs ad-hoc code signing using 'codesign' on the same system. This behavior is indicative of an attempt to bypass macOS Gatekeeper security controls to execute untrusted or malicious binaries.
[IOC based] Surfaces every macOS host that contacts api.ipify.org or ipinfo.io/json. These are MiniRAT's exfiltration endpoints but are also used by many legitimate tools.
This rule detects rapid sequential DNS queries by a single host for multiple domains that mirror common brand impersonation patterns (e.g., login, business, empresas, post-app). The detection logic flags when at least two unique domains matching these patterns are queried within an 18-minute window, which is indicative of potential credential harvesting or phishing reconnaissance.
This rule detects potential network port scanning behavior by identifying a host that initiates connections to both ports 3333 and 3334 on a remote destination within a short time window (15 seconds). This specific pattern is often associated with automated discovery or lateral movement tools probing for specific services.
Detects recurring connection patterns characteristic of the SnappyClient RAT, specifically monitoring for heartbeat-like beaconing at regular intervals on ports 3333/tcp and 3334/tcp. The rule correlates traffic across both ports from the same device to the same destination to identify potential command-and-control communication.
Detects instances where command-line arguments contain sensitive patterns such as cloud provider API keys, secret access keys, environment variable files, or cryptographic seed phrases. The rule specifically flags hosts where multiple such suspicious commands are executed, indicating potential reconnaissance or credential theft activity.
Detects rapid, suspicious command-line activity indicative of unauthorized user account creation or modification within a database environment, specifically targeting 'xadmin' or 'ROLE_ADMIN' roles accompanied by password hashing commands. The rule monitors for multiple events within a 120-second window to identify potentially automated or batch unauthorized account provisioning.
This rule detects potential adversary reconnaissance behavior by identifying hosts executing a combination of common system and network enumeration commands (id, uname, hostname, ifconfig/ip) in short succession. Detecting multiple distinct reconnaissance commands from a single process context may indicate an interactive shell session being used to gather information about the environment.
Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.
Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.
Detects the creation or modification of a file named '.config' within the path 'Library/Application Support/com.apple.finder.core/'. This behavior is indicative of potential persistence mechanisms, as adversaries often use hidden files within application support directories to maintain foothold or store configurations on macOS.
Detects the execution of processes containing command-line arguments '-debugport' or '-lport'. These flags are often used to configure remote debugging or listen ports, which can be abused by adversaries for persistence or command and control (C2) communication.
This rule detects processes accessing sensitive browser credential files ('passwords.json' or 'cookies.json') located in common browser profile output directories. Accessing these files is a common technique used by malware and adversaries to steal stored credentials from web browsers.
This rule detects the execution of Python (pip) or Node.js (npm) package managers with command-line arguments specifying alternative package repositories (e.g., --index-url, --registry) that do not belong to the standard, trusted public repositories (pypi.org or npmjs.com/npmjs.org). This behavior is often indicative of supply chain attacks, where attackers attempt to trick users or automated systems into installing malicious dependencies from compromised or attacker-controlled repositories.
This rule detects potential credential harvesting and sensitive data collection activities on macOS by monitoring for access to keychain databases, browser data files (cookies, logins), and shell history files. It looks for both direct file access and the use of the 'security' utility to dump keychain information.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
For this query, I would recommend performing some threat hunting first and creating a whitelist for known false positives or trusted devices (for example, devices managed by developers). Once the detection is properly tuned, it can be a good way to monitor the download or import of Shebang files on suspicious directories, making it a strong candidate for a threat detection rule.
Page 90 of 174