Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
74
35
16
3
Contributors
128
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
98
28
3
Products / Services
55
14
10
8
7
MITRE Techniques
82
33
30
23
11
CVEs
4
4
1
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects fileless PowerShell execution using an encoded command line consistent with CountLoader v4.5p, corroborated by hidden-window/execution-bypass flags and excluding known legitimate deployment-tool parent processes.
Detects creation of a new Microsoft Edge browser profile with a non-default, non-standard-numbered name, followed within 5 minutes by creation of files/folders containing "extension" or "native" under that profile's User Data path — consistent with the Edgecution malicious Edge extension backdoor installation flow.
Detects execution of a hidden-window .NET loader process launched from Temp/Downloads/AppData Local Temp directories, matching known SMOKE#SCREEN loader binary names or randomly generated 8-character executable names, excluding legitimate Program Files/System32 paths.
Detects execution of processes using filenames associated with the SMOKE#SCREEN campaign's masquerading payloads that either run from non-standard paths or lack a valid code-signing signature, indicating potential dropper or loader activity.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects DeviceManager RAT stager delivered as a Delphi-compiled Inno Setup installer requiring the /SL5 IPC relaunch flag together with an appended high-entropy overlay, plus optional is-DWA04JDXUI.tmp / MicroUpdaterV1.exe indicators, to reduce false positives from benign Inno Setup installers that also use /SL5
Correlates an outbound public-IP lookup (api.ipify.org/ifconfig.me) with a subsequent PBKDF2/SHA-256/XOR-referencing decode operation within 30 seconds on the same process, consistent with DOUBLECUP's environmental-keying anti-sandbox technique.
Detects PowerShell command lines using CountLoader's distinctive custom regex-based JSON-parsing pattern to strip brackets and build hashtables, avoiding the natively-monitored ConvertFrom-Json cmdlet.
Detects a process deleting the exact file it was launched from within 10 seconds of starting, combined with at least one additional suspicious indicator (unusual parent process, encoded command line, or temp/user-writable path), consistent with CountLoader's self-deletion behavior.
Detects CountLoader copying conhost.exe, powershell.exe, and mshta.exe into user-writable directories with p/c/m OneDrive-style name prefixes and patched PE metadata (OriginalFileName), running outside standard system directories.
Detects scripts combining a certutil -decode (or equivalent decode) command, a reference to the cached stego-image.png, and the ZZ1984 embedded marker string used by DOUBLECUP to extract steganographic payloads from PNG images via LSB extraction
Detects rundll32.exe executing a DLL that was written to a user-profile/AppData path within the preceding 15 minutes, consistent with CountLoader's taskType 3 command dispatch downloading and invoking an attacker-specified exported function.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Correlates PowerShell in-memory .NET assembly reflection (System.Reflection.Assembly) with ScriptBlock creation in the same process within a 5-minute window, consistent with CountLoader's reflective payload-loading technique.
Detects CountLoader's taskType 6 command performing a silent MSI installation via msiexec.exe /i /quiet /qn, correlated with a PowerShell parent process or a non-standard (temp/AppData/ProgramData) install source path.
Detects PE binaries with stripped DOS stub, zeroed checksum, and an additional corroborating structural anomaly (zeroed timestamp or entry point outside declared sections), consistent with CountLoader's PE-header patching technique used for in-memory/reflective execution of patched PE images
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Page 5 of 7