Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
42
24
11
6
3
Contributors
88
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
53
24
8
2
1
Products / Services
30
8
7
5
5
MITRE Techniques
64
24
19
19
13
CVEs
7
7
4
IDS Classtypes
1
1
IDS Protocols
2
Detects the fake Adobe Flash update download from microsoft-flash[.]com/download/Adobeinstall.exe, served only after Jewelbug's 'flash' module validates the victim's targeted domain, account status, and OS.
Detects PlugX-style initial-foothold staging: process injection followed within minutes by a dropped file that is then executed, excluding known-benign AV/EDR/updater injectors and targets.
Detects installation of the 'media_updaten' Windows service configured to run Sang.exe with the 'work' argument, used by CoolClient for persistence.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects execution of whoami.exe as NT AUTHORITY\SYSTEM within a short window of, and parented by, a suspicious SYSTEM-privileged shell spawn — a common post-exploitation confirmation step following successful ShieldBreak exploitation. Standalone whoami execution is excluded by design.
Correlates the ShieldBreak PoC's 'Exploit succeeded' console output with a SYSTEM-privileged cmd.exe spawn in the same process session within a short window, confirming successful end-to-end exploitation of CVE-2026-50656.
Detects execution of AutoIt3.exe running the Proper.a3x payload following extraction by the IExpress self-extractor setup_patched.exe (or from its IXP000.TMP staging path) — the initial infection chain observed in the ACRStealer/Amatera BYOVD campaign.
Detects mshta.exe execution combined with CSIS geopolitical lure content or the known TEST.hta downloader artifact used to deliver the Antino backdoor
Detects cmd.exe spawned by the Jewelbug native-messaging helper registered under the Microsoft-masquerading name com.microsoft.runedge, correlated with creation of the corresponding Chrome NativeMessagingHosts registry key — the mechanism the group uses to bridge its malicious 'PDF Viewer' browser extension to an interactive remote shell.
Detects the DeviceManager RAT (run.pyw, spawned via python.exe/pythonw.exe) launching PowerShell or cmd with encoded/obfuscated arguments (-enc, -EncodedCommand, -e, -nop, -w hidden), consistent with C2-tasked arbitrary command execution.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects fileless PowerShell execution that performs Wi-Fi credential dumping via netsh wlan key=clear, accesses browser credential stores, or reads SSO token cache (.tbres) files, consistent with ChocoShell infostealer activity.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects a Claude Code shell-snapshot source invocation followed by additional chained commands (e.g. curl, jq, eval) rather than a clean startup guard, indicating anomalous use of the coding agent's session-init mechanism to smuggle in follow-on actions.
Detects a cmd.exe process spawned as a direct child of a process that just established an outbound connection to a public IP, excluding common RMM/remote-support tools — consistent with Abyssos's C2CMD interactive reverse-shell capability.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects a renamed AutoHotkey interpreter executable (masquerading as another binary via its version-info OriginalFileName field) running from a Temp, Downloads, or AppData folder with no command-line arguments and a co-located, same-named .ahk script file created within an hour, consistent with the AutoHotkey stager technique used by UNC6692 to deploy the Edgecution malware suite.
Detects the ClickFix-style social engineering technique used in the UNC6692 campaign where a victim, prompted via fake 'Outlook Version Verification' / 'OS Version Verification' buttons on a phishing page, is coerced into pasting a clipboard-copied batch or PowerShell script into the Windows Run dialog for execution.
Detects python.exe/pythonw.exe executing compiled bytecode (.pyc/.pyz) from a non-standard installation path (excluding venv/site-packages/Program Files) with an outbound connection to a non-standard port within 5 minutes, consistent with DeviceManager RAT execution.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects su-privileged execution of an embedded ELF payload (libdevice.so or the disguised com.n2.systemservice package) from an application-data directory, consistent with the Kimwolf v7 Android dropper establishing persistence outside standard system binary paths.
Page 2 of 5