Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
317 detections
Filters
Last updated
All Time
Detection languages
126
70
32
24
23
Contributors
98
55
29
20
16
Categories
176
166
98
69
60
Platforms
251
64
48
27
3
Products / Services
80
72
50
31
29
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
7
IDS Classtypes
29
2
1
IDS Protocols
27
2
1
1
This rule monitors the Windows Registry 'RunMRU' key for entries that include command execution patterns such as 'cmd.exe' or '%COMSPEC%' combined with suspicious arguments like 'finger' or 'cmd /c'. The RunMRU key stores the history of commands entered into the Windows 'Run' dialog, and this detection identifies potentially malicious command execution patterns often associated with malware loaders attempting to run secondary payloads or obfuscated commands via the shell history.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)
Detects a PowerShell or command shell process spawned directly by explorer.exe, consistent with a victim using the Win+R Run dialog to paste and execute a clipboard-borne command as instructed by a fake 'Webcam Compatibility'/'SECURITY WARNING'/'Zoom SDK Update' ClickFix modal. Tightened to reduce false positives from routine admin Run-dialog usage by excluding shell invocations that reference a saved script file (-File, .ps1/.bat/.vbs) or common IT support script/deployment paths, since a genuine ClickFix paste-execute is an inline one-off command typed/pasted directly into the Run box rather than a call to a maintained script. Analysts should additionally corroborate with a short-lived explorer.exe parent session (Run dialog opened immediately before the child process spawn) where session telemetry is available.
Detects the macOS ClickFix dropper chain where curl fetches a disguised Mach-O payload (winapp.bin/ZoomSDK.bin) within a process chain that also shows an osascript decoy dialog or a self-deleting shell script, consistent with BlueNoroff's fake meeting-app installer delivery.
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Detects a specific attack chain where users are tricked into copying and pasting a malicious command (ClickFix) that downloads and executes a secondary stager named winPatch.zip via curl or wscript.exe, commonly associated with recent social engineering campaigns.
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Detects the ClickFix execution chain: base64-encoded regsvr32 command pasted into the Windows Run dialog, staging TinyEgg as an OCX payload.
Detects evidence of ClickFix-style social engineering attacks in the Windows Registry RunMRU key. Attackers often trick users into copying and pasting malicious commands into the Run dialog; these commands frequently involve using rundll32.exe with WebDAV paths (@SSL) or headless execution of utilities like conhost.exe to execute malicious payloads.
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
This rule detects PowerShell commands initiated by web browsers that exhibit characteristics of the 'ClickFix' social engineering technique. The detection logic looks for high-risk flags (hidden window, bypass execution policy) associated with common ClickFix artifacts such as references to temporary directories, domain-specific indicators like 'memshowblob.forum', and the removal of Zone.Identifier alternate data streams which are often used to bypass security warnings.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
Detects the 'ClickFix' social-engineering pattern where an adversary tricks a user into opening the Windows Run dialog (Win+R) and pasting a malicious command. This is identified by monitoring for powershell.exe spawned directly by explorer.exe that correlates in time with a new RunMRU registry entry.
Detects ClickFix clipboard-paste payloads by identifying fake 'human verification' comments embedded in the command line of commonly abused Living Off the Land Binaries (LOLBINs). These comments are used by attackers to disguise malicious commands as CAPTCHA steps (e.g., reCAPTCHA, Cloudflare Turnstile, 'not a robot', verification-id, Ray ID). This rule is technique-level and not actor-specific, complementing the ErrTraffic rule.
Detects the execution of command-line processes (e.g., PowerShell, cmd, mshta) where the command arguments contain indicators of copy-paste lures commonly associated with social engineering, such as fake CAPTCHA verification, human verification requests, or 'not a robot' prompts. This behavior is indicative of an attacker tricking a user into executing malicious code via their system's command interpreter.
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Page 10 of 16