Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
74
35
16
3
Contributors
128
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
98
28
3
Products / Services
55
14
10
8
7
MITRE Techniques
82
33
30
23
11
CVEs
4
4
1
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Detects the MSEdgeUpdateService<GUID> fallback scheduled task that runs a patched conhost.exe (csvchost.exe) headless launch or patched PowerShell (psvchost.exe) to re-fetch CountLoader from C2 every 25 minutes.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects short-lived execution of the compiled AppleScript loader from /tmp/p.app, correlated with its rapid creation-then-deletion pattern, the observable proxy for XCSSET's dual-key-encrypted loader architecture.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects XCSSET's 'stats' anti-VM module generating a hardware/CPU-based VM verdict string or exfiltrating the verdict to C2 to gate further module delivery.
Detects a Perl process acquiring and holding an exclusive file lock on the XProtect signature database (XPdb) to prevent macOS security-signature updates from being written to disk.
Detects XCSSET's loader binary staged to /tmp/r and an AppleScript wrapper compiled on the fly at /tmp/p.app, both created and deleted within a short window to erase forensic footprint.
Detects XCSSET's 'stats' anti-VM module generating a hardware/CPU-based VM verdict string or exfiltrating the verdict to C2 to gate further module delivery.
Detects a repeated/looped termination pattern against the CloudTelemetryService process, matching XCSSET's continuous loop that blocks security telemetry from reaching Apple.
Detects a Perl process acquiring and holding an exclusive file lock on the XProtect signature database (XPdb) to prevent macOS security-signature updates from being written to disk.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects a repeated/looped termination pattern against the CloudTelemetryService process, matching XCSSET's continuous loop that blocks security telemetry from reaching Apple.
Detects XCSSET's loader binary staged to /tmp/r and an AppleScript wrapper compiled on the fly at /tmp/p.app, both created and deleted within a short window to erase forensic footprint.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Page 6 of 7