Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
Detects the presence of file system artifacts associated with the malicious Chromium extension 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd) on an endpoint. This extension is known to perform search hijacking and keystroke exfiltration.
Detects the PamStealer second-stage Rust-based arm64 Mach-O infostealer masquerading as Finder, identified by known SHA256 hash and embedded Rust toolchain build artifacts
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
This rule detects the creation of specific hidden files ('.Maccy', '.lock', '.config') within the 'Library/Application Support/com.apple.finder.core/' directory on macOS. This behavior is indicative of potential persistence mechanisms, configuration tampering, or malicious activity related to the Finder application environment.
Detects instances where a process located outside of the standard '/System/' or '/usr/' directories loads the 'Security.framework' library. This behavior is suspicious as it may indicate an attempt by an untrusted or malicious binary to hook into or interact with system-level security services, such as keychain or cryptographic APIs.
Detects unauthorized processes attempting to access sensitive browser data files (Login Data, Cookies, Web Data) that are typically used by web browsers to store credentials and session information. The rule filters out known legitimate browser processes, flagging potential credential theft or session hijacking activity.
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
This rule detects network connections or DNS queries originating from common web browsers (chrome.exe, msedge.exe, chromium.exe) towards domains related to Perplexity AI. Such activity may indicate data exfiltration or the use of AI tools for processing sensitive organizational data via browser-based interfaces.
Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.
This rule monitors outbound network connections from internal hosts to specific ports associated with database management (MySQL: 3306) and service orchestration/discovery (Nacos: 8848, 9848). It aggregates connection counts and distinct target IP addresses by source host and initiating process. High volumes of connections to these specific service ports from unexpected processes may indicate unauthorized discovery, brute-force attempts, or lateral movement.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
Detects browser search traffic being hijacked to the typosquatted domain 'perplexity-ai.online' by the malicious Chromium extension 'Search for perplexity ai'. The rule monitors for network connections to the malicious domain and the presence of extension-related file artifacts on the system. The extension utilizes chrome_settings_overrides to redirect browser Omnibox queries and exfiltrate user search activity to attacker-controlled infrastructure.
Detects MCP (Model Context Protocol) server processes or developer tools spawned by IDE extensions performing environment variable enumeration to access cloud credentials (e.g., AWS, Azure, GCP, GitHub tokens) followed by anomalous outbound network connections, indicating potential exfiltration of sensitive developer environment secrets.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects exploitation attempts against the Flowise Model Context Protocol (MCP) environment, specifically targeting the node_options case-sensitivity bypass (CVE-2026-20182). The rule monitors for malicious node child process spawning, command line injection via the --require flag, suspicious file creation (flowise_marker.txt), and unauthorized outbound network connections from the Flowise process.
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Page 91 of 174