Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
20
7
7
5
1
Contributors
35
3
2
Categories
16
14
12
10
5
Platforms
29
4
4
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
19
19
13
10
9
CVEs
71
71
64
58
49
40
This rule detects instances where a web browser (Chrome, MS Edge, Firefox, or Brave) spawns a command prompt (cmd.exe) with a suspicious command line. The command line is characterized by containing a long string (at least 40 characters) within the user's temporary directory (%temp% or \temp\) and multiple command separators (&&, & rem, tar -xf, or rundll32). This pattern is indicative of the 'ClickFix' attack, often involving malicious copy-pasting from a browser into a command prompt.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (AppData\Roaming\Microsoft\Windows). This activity is suspicious as Notepad++ DLLs are not typically found in this location and could indicate an attempt at DLL side-loading or other forms of execution hijacking.
Detects unauthenticated SQL injection attempts targeting the Ghost CMS Content API by looking for suspicious slug filter ordering syntax (`slug:[` or its URL-encoded equivalent) in the query string. This rule specifically targets a known vulnerability, CVE-2026-26980.
This rule detects the staging of 'NotepadPlusPlus.dll' within the '%APPDATA%\Microsoft\Windows' directory, potentially indicating a Clickfix attack. The presence of 'Start-Process' in conjunction with these strings further strengthens the detection.
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Detects repeated HTTP PUT operations targeting the Ghost CMS admin API for post updates. This rule focuses on network connections or process command lines indicating such activity, retaining principal and target context for further correlation. This activity could be indicative of exploitation of vulnerabilities like CVE-2026-26980, leading to mass compromise and content manipulation.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.
This rule detects the creation of a Run key or login persistence entry by an Electron or Node.js process, where the persistent application is located within the AppData\Local directory. It specifically looks for registry modifications that establish persistence for executables in user-specific application data folders, often indicative of malware or unwanted applications.
This rule detects suspicious JavaScript or HTML files that attempt to cloak browser fingerprints by manipulating WebGL renderer information, timezone settings, touch support, and tampering with the browser console or developer tools. It specifically looks for the co-occurrence of keywords related to these techniques within file names or the effective username associated with the file event.
Detects the specific sequence of commands used in the ClickFix FakeCaptcha attack, moving a ZIP from Downloads, extracting it via tar, and silently executing a batch file. This rule looks for `cmd.exe` processes that contain `move`, `Downloads`, `tar`, `start`, `-xf`, and `/min` in their command line, along with specific payload filenames like `update.zip`, `u.zip`, or `update.bat`.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
Page 2 of 2