Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
76 detections
Filters
Last updated
All Time
Detection languages
37
19
12
5
3
Contributors
76
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
33
23
16
2
1
Products / Services
22
11
6
5
4
MITRE Techniques
45
20
19
9
8
CVEs
11
11
2
1
IDS Classtypes
2
1
IDS Protocols
3
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.
Detects PlistBuddy setting a StartInterval key on a com.*watchdog.plist LaunchAgent from a zsh parent process, indicating a coding-agent-driven persistence mechanism used to relaunch a reverse-tunnel watchdog after reboot or process termination.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects a LaunchAgent plist written to ~/Library/LaunchAgents/ by a non-installer process, correlated with a launchctl load referencing an unsigned/ad hoc binary path within 15 minutes, consistent with the CountLoader macOS variant's persistence mechanism.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects multiple G13-related artifacts (anticheatG13.sys, drv.sys, WindowsData*.log) dropped into Windows Temp or drivers directories within a 15-minute window by the same unsigned initiating process.
Correlates installation of the G13 killer driver (drvsvc service, drv.sys/anticheatG13.sys image) with abnormal termination of known security-product processes shortly after, consistent with kernel-initiated memory corruption.
Detects the MSEdgeUpdateService<GUID> fallback scheduled task that runs a patched conhost.exe (csvchost.exe) headless launch or patched PowerShell (psvchost.exe) to re-fetch CountLoader from C2 every 25 minutes.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects the XCSSET fileless persistence pattern of writing/reading a Base64-encoded payload to a macOS 'defaults' preference domain and piping it directly to a shell interpreter.
Detects malicious .zshrc modifications appending a Base64-decode-and-pipe-to-shell or C2 curl pattern, correlated with Dock persistent-app entries pointing to non-standard/temp paths.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Page 3 of 4