Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects file creation or write operations within protected macOS System 'Application Support' directories that mimic legitimate Finder or system component filenames. This behavior is indicative of an attacker attempting to masquerade malicious files or persistence mechanisms as core macOS system utilities.
Detects repeated execution of the 'pbpaste' command initiated by the 'Finder' application where the parent process path originates from within the '/Library/Application Support/' directory. This behavior is indicative of a potentially malicious macOS plug-in or background component attempting to periodically monitor and extract clipboard data.
Detects a process masquerading as 'Finder' (i.e., having a different file path than the legitimate macOS Finder) that attempts to open System Settings, System Preferences, or the 'open' command to interact with Apple System Preferences related to Full Disk Access or Security settings. This behavior is indicative of an adversary attempting to modify privacy permissions or bypass system security controls.
Detects the execution of the 'csrutil status' command, which is used to check the status of System Integrity Protection (SIP) on macOS. This query specifically looks for this command being executed by 'osascript' or 'Script Editor', which are common methods used to automate or hide the command execution.
Detects instances where 'Script Editor' or processes containing 'Maccy' in their command line access specific timezone files in /usr/share/zoneinfo. This behavior is indicative of potential environment checks for virtualization or sandbox detection, as attackers may attempt to identify or spoof the system's timezone to evade security analysis.
Detects process execution attempts where the binary is located in the /private/tmp directory, specifically targeting a file named 'System Settings'. Executing binaries from temporary directories is a common technique used by attackers to stage and run malicious payloads while attempting to blend in with legitimate-looking filenames.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects AI coding agents (such as Claude Code, Cursor, Copilot CLI, etc.) spawning shell interpreters (bash, cmd, powershell) to execute installation or configuration scripts from within git-cloned repository directories. This activity is indicative of indirect prompt injection attacks where an adversary manipulates the agent into autonomously running malicious setup code.
Detects the execution of the libpwn_cve_2026_55200_server.py Python script, which is identified as a malicious SSH scaffold targeting CVE-2026-55200. This script facilitates exploitation of libssh2 clients by binding to a specific port and delivering malformed packets during the pre-authentication phase.
Detects the execution of Python interpreters spawned by code editors or runtime environments (e.g., VS Code, Cursor, Node.js) with specific command-line arguments involving 'init'. This behavior may indicate an adversary attempting to leverage development tools to execute custom scripts, potentially for automated deployment, persistence, or malicious payload initialization.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects suspicious behaviors during npm package lifecycle events, specifically node.exe spawning command-line interpreters (cmd.exe, powershell.exe, etc.) or initiating network connections to known malicious or suspicious domains typically associated with npm supply chain attacks.
Detects Node.js runtime instances interacting with multiple sensitive developer configuration and credential files (e.g., .gitconfig, GitHub CLI host tokens, Claude configuration, git-credentials) in a single session. This pattern is consistent with infostealer malware (such as Miasma/MYRA) attempting to harvest developer credentials for downstream exploitation.
This rule detects potentially malicious self-upgrade patterns in Node.js applications, specifically monitoring for the execution of scripts like 'sync-peer.cjs', the use of 'BACKUP_TARGET_VERSION' environment variables, or npm packaging commands initiated via lifecycle hooks (e.g., 'postinstall'). These behaviors are characteristic of supply chain attacks or automated persistence mechanisms that attempt to replace or upgrade application code during the installation or execution process.
Detects instances of a Node.js process accessing sensitive browser credential and cookie storage files, which is a common behavior associated with credential theft malware or malicious scripts.
Detects nmap processes performing IPv6 scans (using flags such as -6) that result in abnormal process termination or the spawning of unexpected child processes (e.g., cmd.exe, sh, bash). This behavior is indicative of exploitation attempts targeting the nmap IPv6 extension header length integer wrap vulnerability, including the execution of associated PoC harness binaries.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects injection of malicious DYLIB libraries via LC_LOAD_DYLIB mechanism
Detects multiple processes accessing sensitive browser data files like 'Local State' and 'Login Data', commonly associated with credential theft activities from web browsers.
Detects the presence of the Montana Empire phishing kit within ZIP archives. The rule identifies specific PHP backend components (mentalite.php, panel_track.php, verify_api.php) often used for credential harvesting, along with unique branding strings and artifacts suggesting AI-assisted development of the phishing kit.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Page 99 of 174