Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
20
7
7
5
1
Contributors
35
3
2
Categories
16
14
12
10
5
Platforms
29
4
4
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
19
19
13
10
9
CVEs
71
71
64
58
49
40
Detects JavaScript using the 'ghost_once_footer_' key with localStorage read and write operations, indicative of potential web-based attacks leveraging compromised Ghost CMS instances. This rule specifically looks for the string 'ghost_once_footer_' in conjunction with 'localStorage.getItem' and 'localStorage.setItem', suggesting a mechanism for persistent or one-time data storage in the browser's local storage.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
Detects JavaScript using the 'ghost_once_footer_' key with localStorage read and write operations, indicative of potential web-based attacks leveraging compromised Ghost CMS instances. This rule specifically looks for the string 'ghost_once_footer_' in conjunction with 'localStorage.getItem' and 'localStorage.setItem', suggesting a mechanism for persistent or one-time data storage in the browser's local storage.
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
This rule detects the creation of Electron application runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual or suspicious AppData\Local subdirectories. This behavior is associated with the Ghost ClickFix attack chain, where compromised systems are used to deploy malicious Electron applications. The rule specifically looks for file creations in paths matching `\appdata\local\(super|max|util)[^\\]*` and installer executables named `utilifysetup.exe`, `setup.exe`, or `is-[a-z0-9]+\.exe`.
Detects a single source issuing at least eight HTTP PUT requests to five or more distinct Ghost Admin post objects within a ten-minute window. This activity is indicative of the Ghost ClickFix attack chain, which involves mass modification of blog posts.
Detects the execution of 'rundll32' attempting to load 'installer.dll' and invoke its 'Begin' export function. This activity is often associated with malware, specifically the Clickfix campaign, which uses PowerShell's 'Invoke-WebRequest' to download the DLL.
Detects Electron applications attempting to establish persistence using `setLoginItemSettings` in conjunction with JavaScript code execution (`eval`) or external process execution (`child_process` and `execFile`). This combination is indicative of malicious activity, such as that observed in Clickfix attacks, where an application gains persistence and then executes arbitrary code.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
This rule detects suspicious update requests to the Ghost CMS Admin API that indicate an attempt at dynamic script injection. It specifically looks for PUT requests to `/ghost/api/admin/posts/` containing markers associated with Base64 decoding (`atob(`) and dynamic DOM manipulation (`appendChild`, `createElement`), or specific strings (`ghost_once_footer_`, `btoa(a.origin)`) known to be used in the Ghost ClickFix attack chain. This activity suggests an attacker is attempting to inject malicious JavaScript into Ghost CMS content, potentially leveraging a vulnerability like CVE-2026-26980.
This rule detects the execution of rundll32.exe where it attempts to load a DLL from common user-writable directories (Temp, AppData, Downloads, Users\Public) and specifically calls the 'Begin' export function. This behavior is often associated with malware attempting to execute malicious code via a legitimate Windows binary.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.
This rule detects the execution of a specific command-line sequence involving 'cmd.exe' that is characteristic of the ClickFix attack. The sequence includes moving an 'update.zip' file from the user's downloads, extracting a 'u.zip' file in the temporary directory, and then executing 'update.bat'. This pattern is often associated with malicious copy-paste techniques.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
Detects repeated HTTP PUT operations targeting the Ghost CMS admin API for post updates. This rule focuses on network connections or process command lines indicating such activity, retaining principal and target context for further correlation. This activity could be indicative of exploitation of vulnerabilities like CVE-2026-26980, leading to mass compromise and content manipulation.
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Page 1 of 2