Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects abnormal termination, crash, or error messages related to the 'sharingd' process on macOS. 'sharingd' is a daemon responsible for various sharing features including AirDrop, Handoff, and Instant Hotspot. Unexpected errors or crashes within this process may indicate service instability, potential exploitation attempts, or abnormal interactions with sharing services.
Detects the creation of power management assertions using the IOPMAssertionCreateWithName API by processes other than standard system binaries. Attackers may use this technique to prevent a system from sleeping, which can be leveraged to maintain persistence or ensure that malicious background activities continue without interruption.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
This rule detects potential ransomware activity by identifying processes that perform a high volume of file write, create, or rename operations across a large number of unique file paths within a short timeframe. It also includes a heuristic check for filenames containing 'inc' or 'lynx', often associated with specific ransomware variants.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
This rule detects potentially malicious command-line execution patterns aimed at harvesting sensitive credentials. It monitors for the access or searching of configuration files (e.g., AWS, .env, or Github tokens) and the dumping of environment variables that likely contain API keys or secrets, specifically targeting services like AWS, Anthropic, and GitHub.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
Detects modifications to Chrome or Chromium browser preference files that indicate either the installation of a specific malicious extension or the overriding of the default search provider to a known suspicious domain (perplexity-ai.online). This indicates potential browser-based persistence or search hijacking.
Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
This rule identifies network activity or DNS queries associated with the known malicious domain 'perplexity-ai.online'. It monitors both endpoint network event logs and DNS logs to alert on any attempts to establish communication with or resolve this specific domain.
This rule detects the execution of tools associated with HTTP/2 upgrade queue poisoning proof-of-concept (PoC) code or anomalous process-level interactions involving nghttpx. It tracks specific command-line strings, file operations, and unauthorized spawned sub-processes originating from nghttpx, which could indicate attempts to exploit request smuggling vulnerabilities in HTTP/2 implementations.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
macOS malware used by JINX-0164 against cryptocurrency developers
Page 95 of 174