Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
76 detections
Filters
Last updated
All Time
Detection languages
37
19
12
5
3
Contributors
76
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
33
23
16
2
1
Products / Services
22
11
6
5
4
MITRE Techniques
45
20
19
9
8
CVEs
11
11
2
1
IDS Classtypes
2
1
IDS Protocols
3
Detects installation of the 'media_updaten' Windows service configured to run Sang.exe with the 'work' argument, used by CoolClient for persistence.
Detects scheduled-task persistence launching masqueraded defender.exe/Sang.exe with SYSTEM privileges at startup, outside legitimate Windows Defender/Sangfor install paths.
Detects an unsigned/unexpected PAM module written into the su/sudo authentication stack, correlated with non-package-manager modification of /etc/pam.d/ configuration and subsequent su/sudo activity — the technique Jewelbug's Linux tooling uses to steal credentials.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects DLL sideloading where a renamed Sangfor executable (defender.exe/Sang.exe) loads libngs.dll/libsrapc.dll outside the legitimate install path or with a signer mismatch.
Detects cmd.exe spawned by the Jewelbug native-messaging helper registered under the Microsoft-masquerading name com.microsoft.runedge, correlated with creation of the corresponding Chrome NativeMessagingHosts registry key — the mechanism the group uses to bridge its malicious 'PDF Viewer' browser extension to an interactive remote shell.
Detects creation of the 'goopdate' Run-key value pointing to Sang.exe/defender.exe with the 'work' argument and a %programdata% path, used by CoolClient for persistence.
Detects PlistBuddy setting a StartInterval key on a com.*watchdog.plist LaunchAgent from a zsh parent process, indicating a coding-agent-driven persistence mechanism used to relaunch a reverse-tunnel watchdog after reboot or process termination.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects ClientKing's technique of loading Linux kernel modules directly from memory (via memfd/init_module) without a corresponding on-disk .ko file, used to deploy rootkit functionality.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects CornFlake RAT dropper binaries requiring the svchost32 persistence path, fake update progress window strings, decoy update-lure terms, and Go-binary compiler artifacts together to reduce false positives on unrelated Go binaries or benign installers
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects developer accounts whose daily count of API key creation or model provisioning operations exceeds their own 15-day historical per-user baseline plus several standard deviations, excluding service principals/apps, which may indicate compromised credentials being abused to provision or harvest AI API keys for resale (token jacking).
Detects correlated activity within a 15-minute window combining two or more browser credential-theft indicators: CDP remote-debugging launch, scheduled task with TASK_LOGON_INTERACTIVE_TOKEN, SYSTEM token impersonation, and VSS shadow copy creation.
Detects a process named svchost32.exe running from a non-System32 path that spawns cmd.exe or powershell.exe with a -NoProfile/-NoP flag and subsequently makes an outbound network connection, consistent with CornFlake/ChocoShell remote shell behavior.
Detects UAC bypass attempts abusing SilentCleanup, wsreset.exe, or sdclt.exe via registry hijacks, correlated with the subsequent auto-elevated execution, plus anti-forensic cleanup indicators.
Detects the (currently dormant in observed samples) CountLoader capability to rewrite browser shortcuts so they co-launch conhost.exe --headless alongside a legitimate browser.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects creation of a new Microsoft Edge browser profile with a non-default, non-standard-numbered name, followed within 5 minutes by creation of files/folders containing "extension" or "native" under that profile's User Data path — consistent with the Edgecution malicious Edge extension backdoor installation flow.
Detects recreation of svchost32/Cloud Sync Service persistence (registry Run key, Windows service, or scheduled task) within 15 minutes of removal, indicative of CornFlake backdoor re-installation following remediation.
Page 2 of 4