Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
19
9
5
2
1
Contributors
36
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
19
11
2
2
2
Products / Services
15
8
5
2
2
MITRE Techniques
27
14
8
6
4
CVEs
2
1
1
IDS Classtypes
3
2
IDS Protocols
4
1
Detects Chrome/Chromium processes launched with the --remote-debugging-port flag (optionally combined with --remote-allow-origins or --headless), enabling Chrome DevTools Protocol (CDP) session hijacking as used by AmnesiaStealer's streaming module to remotely control an authenticated browser session. Excludes known automation frameworks (Puppeteer, Playwright, Selenium).
Detects continuous low-frame-rate screenshot capture activity consistent with AmnesiaStealer's remote visual surveillance of a victim's authenticated browser session during live operator control.
Detects an AI agent disclosing system-prompt or safety-policy content, or returning sandbox re-encrypted ciphertext-only output, immediately following a cryptographic-injection-style probe request in the same session — the safety-policy-bypass stage of Cryptographic Context Injection.
Detects silent theft of Apple Notes data via sudo -S cat against NoteStore.sqlite and its -wal/-shm companions from a non-Notes-app process, a technique AmnesiaStealer uses to avoid triggering a TCC prompt.
Detects selective copying of Telegram tdata account directories (matching the 's'-suffix naming convention while skipping emoji/user_data folders) by a non-Telegram process, matching AmnesiaStealer's Telegram session-theft routine.
Detects a Zoom process (zoom.us/zoom.exe/CptHost.exe) writing to the Windows camera/microphone/screen-capture consent-store registry keys while no meeting network activity occurred within 15 minutes before or after, excluding pre-meeting device checks from Zoom Settings — a potential post-exploitation surveillance indicator following ZOOMSDAY RCE.
Detects an embedded AppleScript using Finder's 'duplicate' command to copy Safari cookies, Notes attachments, and the Keychains folder to a randomly named staging directory, avoiding direct TCC prompts as used by AmnesiaStealer.
Detects the malicious 'PDF Viewer' extension (bridged via the com.microsoft.runedge native-messaging helper) requesting both cookie-access and clipboard-access permissions together — the specific combination Jewelbug uses for session-token theft and cryptocurrency address swapping.
Detects a spoofed 'Installer wants to make changes' password prompt dispatched from an unsigned or ad-hoc-signed process, used by AmnesiaStealer to phish the victim's macOS login/keychain password.
Detects a process other than screensharingd bound to or handling network traffic on screensharingd's expected port (5900), indicating exploitation of the connection-interception logic flaw (CVE-2026-43779).
Detects RtkNGUI64.exe creating or writing to tempcache.tmp during command-output staging, scoped to direct process attribution. The rename-away leg of this file's lifecycle is covered by the separate put-command drop-and-rename detection.
Detects a filtered document sweep of Desktop, Documents, and Downloads by sensitive file extensions (including wallet and key files) performed by a single non-standard process, matching AmnesiaStealer's document harvesting routine.
Detects staging and archiving of collected data via ditto -c -k --sequesterRsrc into a randomly named /tmp directory, producing both the main archive and its AppleDouble-style companion zip, matching AmnesiaStealer's pre-exfiltration staging step.
Detects CoolClient's data-collection module: co-occurring keylogging hook installation, clipboard access, and Chromium credential-store file access from an unsigned/non-OS-vendor process.
Detects JWR's real-time keystroke/card exfiltration by matching the hardcoded WebSocket C2 path token together with an instructionAck message containing instruction_id and cvv_id fields.
Detects SilentDataCollector host-based surveillance: recurring screenshot capture, keylogging, WhatsApp Web automation, or known stealer binary execution.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Correlates at least 3 of 4 distinct Abyssos background polling threads (clipboard, process list, network connections, screen capture) launched by the same unsigned/unknown-signature parent process within the same 5-minute window.
Detects the Abyssos HVNC_CLONE_START to GRABCOOKIES to cookie-injection chain: browser profile/cookie staging under a temp fontconfigs folder correlated with a non-browser process connecting to a local Chrome/Edge/Brave remote-debugging port (9222) used for Network.setCookie session hijacking.
Detects SilentDataCollector uploading AES-CBC encrypted, specifically-named archives (desktop_files, pass_V, wallet_V, filelist.zip.encrypted, documents<n>.zip) to the compromised WordPress C2.
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
Page 1 of 2