Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
82
65
21
5
5
Contributors
32
28
21
20
10
Categories
62
58
53
43
38
Platforms
104
68
17
13
9
Products / Services
80
47
41
16
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
43
27
4
4
1
IDS Protocols
55
13
12
Detects suspicious HTTP POST requests to a URI path '/collect' containing specific telemetry parameters ('visitorId', 'timeOnPage', 'stage') characteristic of the 'ClickFix' social engineering campaign. This behavior is used by threat actors to simulate fake bot-protection challenges to trick users into executing malicious code.
FileFix's core mechanism abuses the HTML input type=file element; clicking a lure button launches explorer.exe from the browser while JavaScript copies a disguised PowerShell command to the clipboard.
FileFix's core mechanism abuses the HTML input type=file element; clicking a lure button launches explorer.exe from the browser while JavaScript copies a disguised PowerShell command to the clipboard.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects instances of PowerShell being launched directly by Windows Explorer (explorer.exe), which is indicative of a user interacting with the 'Run' dialog (Win+R). The rule specifically flags common ClickFix social-engineering patterns, such as hidden windows and the use of download/execution cmdlets (e.g., Invoke-WebRequest, Invoke-RestMethod) used to fetch and run remote payloads.
Detects HTTP responses containing keywords associated with ClearFake campaigns hosted on Cloudflare Workers. These pages are typically designed to trick users into downloading malicious files by displaying fake browser verification or captcha pages.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects outbound HTTP requests to a known domain associated with 'ClickFix' campaign activity. The rule identifies attempts to fetch a specific JavaScript tracker file, which is often used in social engineering campaigns to trick users into executing malicious commands in their shell or console.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network indicators associated with the ClearFake campaign, including connections to known dead-drop resolvers (bsc-testnet-rpc.publicnode.com), use of Cloudflare Workers as C2 infrastructure, and the delivery of malicious fake browser-update/CAPTCHA JavaScript payloads.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity related to 'ClickFix' social engineering campaigns. The rules monitor for DNS queries, TLS SNI requests, and HTTP requests to the malicious domain 'cdnsuicaches.com' used for hosting malicious scripts, as well as the identification of the 'cookie-captcha-complete' string in HTTP traffic, which is a known indicator of a ClickFix social engineering overlay.
Page 2 of 9