Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
42
24
11
6
3
Contributors
88
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
53
24
8
2
1
Products / Services
30
8
7
5
5
MITRE Techniques
64
24
19
19
13
CVEs
7
7
4
IDS Classtypes
1
1
IDS Protocols
2
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects fake Adobe Flash/Adobe installer executables used by Jewelbug to drop the Antino backdoor, sideload slc.dll, install the 'PDF Viewer' extension, and register the com.microsoft.runedge native-messaging helper. Requires known filenames combined with known hashes or slc.dll/indicator strings, and excludes files carrying a valid Adobe code-signing certificate.
Detects the CaptiveCrunch ClickFix execution chain where a browser or Explorer process spawns a command interpreter that launches an unsigned or non-standard-vendor 'update'-named binary from a Temp/Downloads path, which then establishes a network connection (C2) within 5 minutes of process start.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects an APK file written to disk by a browser process within 15 minutes of that browser visiting a non-standard landing page, consistent with CaptiveCrunch/ClickFix Android APK delivery.
Detects PowerShell (or pwsh) processes that both download a file to a temp-like location and subsequently execute or install it within a short time window on the same host, indicative of a staged loader/dropper download-and-execute pattern.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects a process named svchost32.exe running from a non-System32 path that spawns cmd.exe or powershell.exe with a -NoProfile/-NoP flag and subsequently makes an outbound network connection, consistent with CornFlake/ChocoShell remote shell behavior.
Detects the ClickFix pattern of a clipboard copy event followed within 5 seconds by an encoded/base64 mshta.exe or powershell.exe execution, consistent with DOUBLECUP's clipboard-hijacking lure.
Detects python.exe binding a loopback listener on port 8000, 8001, or 8002 and then spawning cmd.exe or powershell.exe within 5 minutes of the listener being established, consistent with SNOWBASIN Python bindshell behavior observed in the UNC6692 Edgecution campaign.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Detects the STAC4749 malicious vcruntime140_1.dll sideloaded via trojanized CopyQ binary, communicating with imarketads.com and launching sekv*.exe loader
Detects a browser-spawned explorer.exe chain launching powershell.exe, cmd.exe, mshta.exe, or rundll32.exe with both base64/obfuscation indicators and fake-update/support-dialog keywords in the command line, consistent with ClickFix-style social engineering.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects fileless PowerShell execution using an encoded command line consistent with CountLoader v4.5p, corroborated by hidden-window/execution-bypass flags and excluding known legitimate deployment-tool parent processes.
Detects the Edgecution native messaging host chain where a batch wrapper (native_host.bat), spawned by msedge.exe, launches python.exe with the unbuffered output flag (-u) to run the malicious native_host.py backend used for C2 command execution.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.
Detects the DOUBLECUP ClickFix Stage 1 execution chain where a cmd /c for/f loop searches for powershell.exe via the wildcard pattern 'where pow?r?hell.exe' and pipes through findstr "ZZ1984" to locate and extract the steganographic PNG payload marker before invoking PowerShell.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Page 3 of 5