Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
21
15
4
4
2
Contributors
11
9
7
5
5
Categories
12
11
8
8
8
Platforms
41
4
2
2
1
Products / Services
13
9
8
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects execution of the CHOSEN BRICK implant (process names smdqservice.exe or winappx.exe) initiating a network connection to Telegram infrastructure (C2) followed by a network connection to a cloud object-storage provider (vultrobjects.com, storjshare.io, or backblazeb2.com) for data exfiltration within a 30-minute window.
Detects execution of the CHOSEN BRICK implant (process names smdqservice.exe or winappx.exe) initiating a network connection to Telegram infrastructure (C2) followed by a network connection to a cloud object-storage provider (vultrobjects.com, storjshare.io, or backblazeb2.com) for data exfiltration within a 30-minute window.
Detects the creation of common audio file formats (wav, mp3, m4a, etc.) by processes associated with the CHOSEN BRICK persistence mechanism (SMQDService and winappx). This pattern is consistent with unauthorized microphone-based surveillance behaviors.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects instances where Google Chrome accesses the camera or microphone without a preceding browser-based user interaction event (such as a mouse click or user input). This can indicate malicious browser extensions or hijacked processes attempting to surreptitiously capture audio or video.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects the Chrome process attempting to programmatically modify the Windows CapabilityAccessManager ConsentStore registry keys for microphone or webcam access. This behavior is indicative of unauthorized programmatic access to system audio/video peripherals, often associated with browser-based AI agent hijacking or malicious extensions attempting to bypass user interaction requirements.
Detects instances where the Chrome browser process accesses camera or microphone hardware, or invokes media device APIs, potentially indicating unauthorized audio or video recording.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects a Zoom process (zoom.us/zoom.exe/CptHost.exe) writing to the Windows camera/microphone/screen-capture consent-store registry keys while no meeting network activity occurred within 15 minutes before or after, excluding pre-meeting device checks from Zoom Settings — a potential post-exploitation surveillance indicator following ZOOMSDAY RCE.
Detects screen-recording or AI voice-transcription applications (iTop Screen Recorder, Krisp, Caption.Ed) running within 60 minutes of an active videoconferencing session, consistent with PurpleDelta operators recording or transcribing interviews or meetings to generate scripted answers.
Detects audio_start/audio_stop C2 command tokens with base64 WAV audio_data exfiltration in the TAG-195 message schema.
Detects modifications to the Windows microphone consent registry key (CapabilityAccessManager\ConsentStore\microphone) by processes running outside of standard Windows system directories (System32 or SysWOW64). This behavior is characteristic of unauthorized software attempting to grant itself persistence or surreptitiously gain access to audio hardware.
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
Detects the execution of multimedia capturing utilities like ffmpeg or OBS Studio when spawned by common scripting or administrative processes. This pattern often indicates unauthorized screen, audio, or video recording potentially used in data exfiltration or reconnaissance.
Detects the execution of multimedia capturing utilities like ffmpeg or OBS Studio when spawned by common scripting or administrative processes. This pattern often indicates unauthorized screen, audio, or video recording potentially used in data exfiltration or reconnaissance.
Detects behavior indicative of the Remcos RAT, specifically the use of the Windows Wave API or avicap32.dll for silent audio and webcam recording, followed by the persistence of recorded files in the C:\MicRecords directory.
Detects Android applications exhibiting multiple sensitive behaviors simultaneously within a 5-minute window, such as screen recording, audio capture, GPS tracking, and unauthorized access to SMS, call logs, or contacts. This behavior is strongly indicative of malicious mobile spyware.
Detects the loading of avicap32.dll by non-conferencing processes executing from user-writable directories such as AppData or Temp. This behavior is indicative of Remcos RAT or similar remote access trojans attempting to covertly capture audio or video using Windows API modules commonly used for media capture.
Page 1 of 3