Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
42
24
11
6
3
Contributors
88
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
53
24
8
2
1
Products / Services
30
8
7
5
5
MITRE Techniques
64
24
19
19
13
CVEs
7
7
4
IDS Classtypes
1
1
IDS Protocols
2
Detects known CornFlake and ChocoShell malware binaries by exact full SHA-256 hash of executable files (file-write/process-creation scope), not incidental hash string mentions
Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.
Detects non-standard processes, particularly fileless PowerShell, accessing Windows Token Broker cache (.tbres) files, a technique associated with ChocoShell credential/token theft.
Detects at least two of three macOS profiling subprocess commands (sw_vers -productVersion, system_profiler SPHardwareDataType, ioreg -rd1 -c IOPlatformExpertDevice) spawned by the same parent process within a 2-minute window, consistent with the CountLoader macOS variant's system-profiling routine.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Correlates PowerShell in-memory .NET assembly reflection (System.Reflection.Assembly) with ScriptBlock creation in the same process within a 5-minute window, consistent with CountLoader's reflective payload-loading technique.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Detects CountLoader's taskType 5 command dispatch: a PowerShell script block that downloads content (Invoke-WebRequest/DownloadString) then pipes it to Invoke-Expression with a subsequent main() function call, consistent with fetched reconnaissance modules executed in memory.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects the MSEdgeUpdateService<GUID> fallback scheduled task that runs a patched conhost.exe (csvchost.exe) headless launch or patched PowerShell (psvchost.exe) to re-fetch CountLoader from C2 every 25 minutes.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Detects a WordPress admin plugin ZIP upload to wp-admin/update.php?action=upload-plugin only when correlated with high-risk context: the observed wp2shell_ plugin naming convention, evidence of a just-created/unfamiliar administrator account (wp-admin/user-new.php activity in the same capture), or the upload occurring immediately after REST API batch-route/SQLi anomalies (wp-json/batch/v1, author__not_in) tied to CVE-2026-63030 and CVE-2026-60137. Routine plugin uploads by established administrators without these correlating indicators are excluded.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Page 4 of 5