Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
133 detections
Filters
Last updated
All Time
Detection languages
48
43
12
11
6
Contributors
33
24
17
10
8
Categories
53
48
29
23
19
Platforms
107
21
18
4
1
Products / Services
28
23
14
9
8
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects Node.js processes performing clipboard monitoring or screenshot capture using npm packages like screenshot-desktop, consistent with Contagious Interview spyware.
This rule set detects components of the ClipXDaemon, a Linux clipboard hijacker. The first rule, 'ClipXDaemon_Bincrypter_Loader', identifies a loader component characterized by specific strings related to process information, OpenSSL, gzip, and a pattern of variables (P, S, C, R) often used in shell scripts for unpacking, all within a small file size. The second rule, 'ClipXDaemon_ELF_Clipboard', targets the main ELF executable of ClipXDaemon. It looks for an ELF file that interacts with X11 clipboard functions (XConvertSelection, XSetSelectionOwner), attempts to masquerade its process name as 'kworker/0:2-events', and contains hardcoded cryptocurrency wallet addresses used by the attacker. Together, these rules aim to identify both the unpacking mechanism and the core functionality of the ClipXDaemon malware, which is designed to swap cryptocurrency wallet addresses from the clipboard.
Detects the deletion of the RunMRU registry key and the clearing of the clipboard within a short time window on the same host. This sequence of anti-forensic actions is used by the batch script component of the Dohdoor malware campaign to hide its tracks.
The rule detects the creation of processes that utilize specific mutex names associated with the Allcome clipper malware. Specifically, it looks for the mutex name '08841d-18c7-4e2d-f7e29d'. This indicates potential Allcome clipper activity on a Windows system.
Detects known mutexes associated with Keyzetsu Clipper activity. This rule specifically looks for the presence of a mutex named '2ILdX2JpexVZieT6mPv2i6Jp3HNFPlby' during process creation events on Windows systems.
The rule detects the creation of a process that utilizes a specific mutex name, 'YourMutex'. This mutex name is associated with Atlas Clipper malware activity. The detection aims to identify potential Atlas Clipper infections by monitoring for this known indicator.
The rule detects the presence of specific mutex names ('7CmLQX') that are known to be associated with the Paradies Clipper malware. This indicates potential activity of the Paradies Clipper malware on the system.
Monitors for the creation of 'C:\ProgramData\AppxProvisioning.xml'. The updated CoolClient backdoor, used by the HoneyMyte APT group, uses this specific file path to store XOR-encrypted clipboard and active window monitoring data.
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Detects FileFix campaigns that use clipboard manipulation functions in web pages to deliver malicious PowerShell commands. These campaigns often trick users into copying and executing payloads, sometimes involving steganography with image files.
Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
A keylogger is an insidious form of spyware. when we enter sensitive data onto keyboard, believing nobody is watching. In fact, keylogging software is hard at work logging everything that you type. Keyloggers are activity-monitoring software programs that give hackers access to your personal data. The passwords and credit card numbers you type, the webpages you visit – all by logging your keyboard strokes. The software is installed on your computer, and records everything you type. Then it sends this log file to a server, where cybercriminals wait to make use of all this sensitive information.
This rule looks for the usage of less common PowerShell modules which interface directly with the current user's clipboard. This could be an attempt to steal sensitive data or attempt to modify clipboard contents.
Detects clipboard manipulation from browser processes, often used in ClickFix attacks where malicious content is copied to the clipboard for users to paste into terminals.
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query
KQL Query from file: MDE KQL to detect TA571 socialengineering abuse
Page 5 of 7