Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
42
24
11
6
3
Contributors
88
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
53
24
8
2
1
Products / Services
30
8
7
5
5
MITRE Techniques
64
24
19
19
13
CVEs
7
7
4
IDS Classtypes
1
1
IDS Protocols
2
Detects ClickFix-style initial access where a Run-dialog-spawned interpreter (cmd.exe, powershell.exe, mshta.exe, cscript.exe) executes an encoded or obfuscated command line, consistent with clipboard-paste delivery of C2Looper.
Detects the botking RAT issuing Shell/ShellX/runscript commands that spawn powershell.exe from an implant-named parent process, matching the backdoor's remote command-execution capability.
Detects the ClickFix-style Terminal dropper pattern: zsh/Terminal.app spawning bash with a piped base64-decode or curl-download command redirected through nohup, matching AmnesiaStealer's counterfeit GitHub 'Download for macOS' lure page execution chain.
Detects the StopAndProtect ClickFix lure: a fake CAPTCHA/human-verification page tricks victims into pasting and running a clipboard-staged PowerShell command (Win+R, Ctrl+V, Enter) that downloads and runs vcapcha.ps1.
Detects process command lines matching the documented BTR_CLI.exe flag combinations (-chain/-item, -trigger now|boot, -cleanup) used to orchestrate chained kernel file/registry operations via the BTR.sys primitive.
Detects process activity referencing the typosquatted proc-macro1 crate or build-script-build.exe spawning a child process — the build-time execution chain used to trigger the malicious proc-macro1 payload on Windows build hosts.
Detects ClickFix-style initial access where a Run-dialog-spawned interpreter (cmd.exe, powershell.exe, mshta.exe, cscript.exe) executes an encoded or obfuscated command line, consistent with clipboard-paste delivery of C2Looper.
Detects a SYSTEM-privileged cmd.exe/powershell.exe process spawned in close temporal/process proximity to Microsoft Defender's scanning process (MsMpEng.exe), consistent with successful exploitation of the ShieldBreak zero-day (CVE-2026-50656) TOCTOU bypass. Excludes known legitimate SYSTEM shell spawns from scheduled tasks, SCCM/Intune, and PsExec-style tooling.
Detects C2Looper's remote interactive shell and ShellExecuteW run-and-self-delete command execution, correlated with the c2_out.txt output-capture artifact.
Detects C2Looper's remote interactive shell and ShellExecuteW run-and-self-delete command execution, correlated with the c2_out.txt output-capture artifact.
Detects the StopAndProtect two-stage PowerShell chain: stage 1 downloads/executes stage 2, which reflectively loads a base64-encoded .NET assembly and invokes an Execute method.
Detects an embedded AppleScript using Finder's 'duplicate' command to copy Safari cookies, Notes attachments, and the Keychains folder to a randomly named staging directory, avoiding direct TCC prompts as used by AmnesiaStealer.
Detects ClickFix-style clipboard/paste-and-run execution: PowerShell, PowerShell ISE, mshta, or cmd spawned from the Windows Run dialog (explorer.exe/RunMRU) with IEX/Invoke-Expression/DownloadString/FromBase64String or mshta HTTP(S) invocation, consistent with the UNC5142 ClickFix lure delivering the DeviceManager RAT.
Detects wscript.exe executing OptiDrive.vbs from the %LOCALAPPDATA%\DriveOptimize Technologies\ masquerade directory to invoke the renamed AutoIt interpreter OptiDrive.exe — the ACRStealer staging/masquerade technique.
Detects a build process (cargo/rustc/build-script-build) that drops an executable to /tmp/rust-setup and launches it detached so it persists after the build completes — the payload-delivery mechanism used by the compromised proc-macro1 Rust crate.
Detects loading of Warden.dll — the Defender-bypass component of the ShieldBreak exploit — when unsigned or not signed by Microsoft, excluding legitimate signed Defender platform update binaries.
Detects a browser-triggered 'Allow this website to open Script Editor?' permission prompt, the initial step AmnesiaStealer uses to enable AppleScript-based execution outside the browser sandbox.
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
Consolidated detection for RtkNGUI64.exe spawning cmd.exe to execute CMD= tasking (SYSTEM/PUT/TIME verbs). Merges two previously separate rules that detected the same underlying signal via different tasking-mechanism angles.
Detects non-interactive PowerShell launched via the Sysnative path with -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command - reading commands from stdin — the ACRStealer payload's command-execution technique.
This rule detects potentially malicious command execution initiated within Claude Code's zsh shell-snapshot environment on macOS. It triggers when a zsh process executes a command via the internal shell-snapshot wrapper and subsequently performs high-risk activities such as credentialized HTTP requests, unauthorized data exfiltration/upload, download-and-execute shell chains, tunneling (e.g., ngrok, cloudflared, SSH port forwarding), persistence mechanism manipulation (e.g., LaunchAgents/LaunchDaemons, PlistBuddy), credential access (e.g., keychain queries), or defense evasion techniques (e.g., clearing quarantine attributes or ad-hoc codesigning).
Page 1 of 5