Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
FileFix's core mechanism abuses the HTML input type=file element; clicking a lure button launches explorer.exe from the browser while JavaScript copies a disguised PowerShell command to the clipboard.
StealC v2, the payload consistently delivered via FileFix campaigns, is capable of stealing cryptocurrency wallet data alongside credentials and VPN configs.
Because FileFix commands are typed/pasted directly into the Explorer address bar rather than downloaded, executed content never receives a Mark-of-the-Web tag, sidestepping SmartScreen-style controls.
A FileFix sibling technique dubbed DownloadFix uses a broken/incomplete download to prompt the victim to manually execute a .cmd file via the browser's Downloads shortcut instead of the Explorer address bar.
After the initial FileFix paste-and-execute step, observed campaigns chain into a secondary download of the real payload using LOLBins or PowerShell web clients.
Acronis reported a multilingual FileFix phishing site using anti-analysis techniques and advanced obfuscation, chaining into a Go-based loader with string encryption before deploying StealC.
This rule detects a behavioral chain characteristic of the KongTuke/LandUpdate808 threat actor group. It identifies the correlation between a browser initiating a network connection to a domain with a low-reputation top-level domain (TLD) and that same browser process launching 'explorer.exe' within a 60-second window. This behavior is associated with social engineering lures (fake CAPTCHA) that encourage users to execute clipboard commands, which trigger file-picker dialogs via explorer.exe to facilitate follow-on malicious activity.
FileFix JavaScript silently writes the malicious command to the clipboard the instant the lure button is clicked, producing a much shorter human-reaction interval between browser launch and shell spawn than a manually typed path would allow.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects the use of the WinGet 'configure' command to process PowerShell DSC configuration files. This method can be abused to execute arbitrary PowerShell code within a Script resource without explicitly invoking powershell.exe, potentially bypassing certain monitoring or security controls focused solely on the PowerShell executable.
Detects instances where cmd.exe spawns a PowerShell process with the '-executionpolicy bypass' argument. This pattern is commonly used by attackers to execute malicious scripts while circumventing Windows PowerShell execution policy restrictions.
Detects the download and subsequent extraction of the Python embeddable zip package to directories under 'C:\Users\Public'. This activity is consistent with techniques used by threat actors, such as APT37, to establish a covert Python runtime environment on a compromised host for further malicious operations.
Detects the execution of cmd.exe spawned by explorer.exe that contains suspicious command line parameters. The rule specifically targets the use of obfuscated Windows batch substring expansion (e.g., %VAR:~0,1%) or commands being executed directly from common user-writable directories like Temp or Downloads, which are common indicators of malicious LNK file abuse.
Detects the use of Windows command shell variable substring expansion to obfuscate commands. Adversaries use this technique to build malicious command lines dynamically, making them less visible to standard keyword-based detection mechanisms by storing parts of strings in environment variables and reassembling them using substring notation (e.g., %var:~start,length%).
Detects the execution of the Windows ftp.exe binary using the -s parameter (or -s"": syntax) to execute a script file. This behavior is commonly associated with attackers using LOLBAS (Living Off the Land Binaries and Scripts) techniques to execute hidden or obfuscated scripts from mounted virtual hard disks (VHD) to facilitate malicious backdoor execution.
Detects the use of the Windows command shell 'copy' utility to concatenate separate files, such as 'header.doc' and 'body.doc', into an executable file named 'Windowsupdate.exe'. This technique is commonly used by adversaries to reassemble malicious payloads that were split to evade signature-based detection or bypass security controls.
Detects the creation of a 'SystemIn.lnk' persistence shortcut on Windows systems using PowerShell and the WScript.Shell COM object. This activity is associated with the QUICAgent backdoor, part of the QUICSILVER operation, which uses temporary PowerShell scripts to establish persistence.
Detects the execution of AutoIt3.exe or AutoIt-related scripts (.a3x, .au3) spawned by mshta.exe. MSHTA is a legitimate utility that can be abused to proxy the execution of malicious code, and in this context, it may be used to launch AutoIt scripts to evade security controls or execute payloads.
Detects the creation or modification of a Windows service named 'ProcAuditManager' using 'sc.exe' or 'services.exe' command-line utilities, or by direct modification of the associated registry key. This activity may indicate persistence establishment or service manipulation by an adversary.
Detects potential Casbaneiro banking trojan activity characterized by a user accessing a known Latin American banking domain via a web browser, followed within 10 minutes by a suspicious process (RegSvcs.exe or mobsync.exe) establishing an outbound network connection, which is consistent with command-and-control (C2) behavior often seen in this malware family.
Page 112 of 977