Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
28
5
4
1
Contributors
38
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
38
2
2
Products / Services
14
10
5
4
2
MITRE Techniques
8
6
6
6
5
CVEs
10
Detects sustained HTTP reverse-shell beaconing, SOCKS5 proxy handshake patterns, or TOR-like traffic on TOR guard/entry ports, originating from a non-browser process, consistent with OnyxC2's multi-channel remote-access toolkit.
Detects execution of the dropped Setup_File_92.118.3096.exe installer from a Temp\RarSFX extraction path where the binary carries an untrusted or invalid Authenticode certificate.
Detects creation of the ONYXC2 mutex used by the malware to enforce single-instance execution.
Detects contact with the OnyxC2 lure landing page performing canvas fingerprinting (multiboardthe.com) correlated with a subsequent registry write from the known dropper process, tying victim-vetting to the OnyxC2 install chain.
Detects extraction and execution of OnyxC2 lure archives (Setup_File*.zip, Fling-Standalone*.zip) via WinRAR/7-Zip from a Downloads/Temp directory, correlating the archive-open with the lure-named installer executing shortly after.
Matches endpoint file/process hashes and network IPs against a curated, freshness-checked OnyxC2 indicator feed.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects the full RunPE process-hollowing sequence (suspended process creation, WriteProcessMemory, SetThreadContext, ResumeThread) executed within 30 seconds against an unsigned, non-OS target process.
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Page 2 of 2