Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Identifies network connections to known ShinyHunters IP addresses or domains associated with the recent Oracle PeopleSoft exploitation campaign. This rule monitors both endpoint network events and perimeter firewall/proxy logs for outbound communication to the specified malicious infrastructure.
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
This rule detects the creation of Amazon Q Model Context Protocol (MCP) configuration files, identified by 'mcp.json' in specific directories. It additionally correlates this file creation event with concurrent Git operations (checkout, merge, pull, or fetch) performed by a user, flagging the activity as a higher risk signal if both conditions are met.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects network requests to a typosquatted domain 'perplexity-ai.online' initiated by a malicious browser extension. The extension uses the 'suggest_url' feature to exfiltrate keystrokes typed into the browser omnibox in real-time, effectively performing browser-based keylogging.
Detects anomalous or unauthorized processes accessing sensitive AI configuration files, SSH configurations, version control files, and shell history within a short time window. The rule flags instances where non-standard or unexpected applications exhibit broad or high-frequency access to these files, which are common targets for credential harvesting or exfiltration by adversaries.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
This rule detects the use of the 'SecTrustSetAnchorCertificatesOnly' macOS Security framework API call. This API is used to restrict trust to only the anchor certificates provided, which is a technique often used by malware or malicious scripts to bypass security trust controls, intercept TLS/SSL traffic, or facilitate adversary-in-the-middle attacks.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Detects anomalous process spawning where VS Code or Amazon Q language server processes (e.g., node, amazonq-lsp) execute shell utilities (e.g., bash, curl) with arguments related to .amazonq/mcp.json or specific credential/exfiltration commands. This behavior is associated with the exploitation of the MCP server auto-execution vulnerability (CVE-2026-12957).
Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.
Detects rapid or aggregate access to multiple sensitive credential or configuration files across various applications (e.g., AWS, Docker, Kubernetes, Crypto wallets, AI tools) within a short timeframe. This behavior is indicative of credential harvesting or post-compromise reconnaissance to steal secrets and keys.
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Page 97 of 174