Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
20
15
4
3
Contributors
42
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
25
14
2
1
1
Products / Services
14
6
4
4
3
MITRE Techniques
15
13
6
5
5
CVEs
4
3
3
1
Detects CoolClient's elevated self-relaunch using the 'passuac' command-line parameter combined with RPC-based process creation and PPID spoofing to bypass UAC.
Detects the Abyssos UAC_BYPASS_FODHELPER technique: a ms-settings\Shell\Open\command registry value set immediately before fodhelper.exe launches an unsigned child payload, silently elevating to a high-integrity process without a UAC prompt.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Correlates AES-CBC shellcode decryption (EXECURL_AES_HOL/EXECLOCAL_AES_HOL/AESHOL) with a preceding external download and a full VirtualAllocEx-WriteProcessMemory-CreateRemoteThread injection sequence into a named target process within 1 hour.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects ClientKing's technique of loading Linux kernel modules directly from memory (via memfd/init_module) without a corresponding on-disk .ko file, used to deploy rootkit functionality.
Detects the Abyssos UAC_BYPASS_ICMLUAUTIL technique: a process referencing the ICMLuaUtil COM interface/CLSID that ends up running at High/System integrity without going through consent.exe.
Detects correlated activity within a 15-minute window combining two or more browser credential-theft indicators: CDP remote-debugging launch, scheduled task with TASK_LOGON_INTERACTIVE_TOKEN, SYSTEM token impersonation, and VSS shadow copy creation.
Detects UAC bypass attempts abusing SilentCleanup, wsreset.exe, or sdclt.exe via registry hijacks, correlated with the subsequent auto-elevated execution, plus anti-forensic cleanup indicators.
Detects the (currently dormant in observed samples) CountLoader capability to rewrite browser shortcuts so they co-launch conhost.exe --headless alongside a legitimate browser.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects lure-named payloads executing from Temp/AppData/Downloads paths that perform a self-elevation check followed by a RunAs relaunch, consistent with the SMOKE#SCREEN campaign's VBScript/batch installer behavior.
Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.
Detects lure-named payloads executing from Temp/AppData/Downloads paths that perform a self-elevation check followed by a RunAs relaunch, consistent with the SMOKE#SCREEN campaign's VBScript/batch installer behavior.
Detects a LaunchAgent plist written to ~/Library/LaunchAgents/ by a non-installer process, correlated with a launchctl load referencing an unsigned/ad hoc binary path within 15 minutes, consistent with the CountLoader macOS variant's persistence mechanism.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Page 2 of 2