Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
63
6
2
Contributors
24
22
8
6
3
Categories
53
48
44
26
20
Platforms
61
11
7
3
2
Products / Services
63
59
5
2
2
MITRE Techniques
35
31
26
14
14
IDS Classtypes
1,937
503
461
381
236
71
IDS Protocols
45
10
4
Multi-layered detection for two linked March 2026 threat campaigns identified by ANY.RUN and Objective-See:
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
Identity LOLBA trying to dump AD server credentials and security information´s
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
KQL Query from file: Clickfix Win + R Detection
This rule detects potential Browser-in-the-Browser (BITB) phishing attacks, specifically targeting the 'Sneaky2FA' technique. It looks for HTTP responses containing an iframe, base64 encoded image data, and the string ';base64,', which are indicators of a malicious page attempting to mimic a legitimate login portal within an iframe to steal credentials.
Mimikatz payload has been executed on a system as one-liner likely to output to a file for collection
This rule is to identify when the registry key (SYSTEM\CurrentControlSet\Control\SecurityProviders\ WDigest\UseLogonCredential OR SYSTEM\ControlSet00*\Control\SecurityProviders\ WDigest\UseLogonCredential) is modified signaling a possible WDigest downgrade attack, which was recently seen and attributed to the SmokedHam tool from UNC2465 and its affiliates.
This rule detects HTTP POST requests to github.com's /login/device/code endpoint containing a 'client_id=' parameter in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens or facilitate unauthorized access to GitHub accounts.
Page 4 of 4