Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
13
10
5
4
3
Contributors
35
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
14
13
4
3
3
Products / Services
5
5
4
3
3
MITRE Techniques
9
8
6
5
5
CVEs
3
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects the ClickFix-style Terminal dropper pattern: zsh/Terminal.app spawning bash with a piped base64-decode or curl-download command redirected through nohup, matching AmnesiaStealer's counterfeit GitHub 'Download for macOS' lure page execution chain.
Detects the presence of known malicious Rust crate archive files (arrayref-0.3.10.crate, proc-macro1-*, and related typosquatted package names) in a host's local Cargo registry cache, indicating the compromised dependency was fetched.
Detects the StopAndProtect ClickFix lure: a fake CAPTCHA/human-verification page tricks victims into pasting and running a clipboard-staged PowerShell command (Win+R, Ctrl+V, Enter) that downloads and runs vcapcha.ps1.
Detects process activity referencing the typosquatted proc-macro1 crate or build-script-build.exe spawning a child process — the build-time execution chain used to trigger the malicious proc-macro1 payload on Windows build hosts.
Detects known malicious stage-2 payload binaries dropped by the compromised proc-macro1/arrayref Rust supply-chain attack via hash, size, and file-type match.
Detects crates.io publish events combining an impersonation indicator (attacker account names/forged author email) with one of the known malicious package names, indicating a compromised or impersonated maintainer account was used to publish the Rust supply-chain payload.
Detects a victim's WhatsApp Web session being abused to automatically propagate ClickFix lure links to contacts, correlated with recent infection indicators.
Detects HTTP requests to the malicious 'verify' WordPress plugin serving the fake CAPTCHA ClickFix overlay.
Detects HTTP requests to StopAndProtect's WordPress webshells and malicious MU-plugin backdoor endpoints.
Detects a new build-dependencies entry adding a networking crate (ureq/reqwest/rustls) to a Cargo.toml that previously had no such dependency, correlated with a recent Cargo.lock modification, flagging a package gaining unexpected build-time network capability.
Detects a root-privileged Screen Sharing session with no successful authentication event in the preceding window, indicating exploitation of the screensharingd pre-auth bypass (CVE-2026-65400); excludes known ARD/MDM admin workflows.
Detects the RFB protocol length-field bypass frame pattern used to exploit the screensharingd pre-auth authentication bypass (CVE-2026-65400) on ports 5900/5988.
Detects spearphishing email impersonating the CSIS 'Indo-Pacific Forecast 2026' invitation-only event lure, gated on CSIS branding/display name combined with a sender domain that does not match csis.org.
Detects the fake Adobe Flash update download from microsoft-flash[.]com/download/Adobeinstall.exe, served only after Jewelbug's 'flash' module validates the victim's targeted domain, account status, and OS.
Detects PlugX-style initial-foothold staging: process injection followed within minutes by a dropped file that is then executed, excluding known-benign AV/EDR/updater injectors and targets.
Detects the NaviTheClown ARM64 Go PoC binary exploiting the screensharingd Frame Length pre-auth bug to download arbitrary files as root
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects execution of AutoIt3.exe running the Proper.a3x payload following extraction by the IExpress self-extractor setup_patched.exe (or from its IXP000.TMP staging path) — the initial infection chain observed in the ACRStealer/Amatera BYOVD campaign.
Detects accounts authenticating from compromised webmail/CMS infrastructure that pivot, within a tight time window and matching source IP, to authenticate against internal virtualization-management systems — the lateral-movement pattern Jewelbug used to reach a national webmail estate's backing infrastructure.
Detects mshta.exe execution combined with CSIS geopolitical lure content or the known TEST.hta downloader artifact used to deliver the Antino backdoor
Detects phishing emails impersonating AI/LLM service providers that reference API keys or developer consoles and contain embedded URLs to login/signin/auth/console pages, consistent with token-jacking campaigns harvesting developer credentials.
Page 1 of 2