Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
317 detections
Filters
Last updated
All Time
Detection languages
126
70
32
24
23
Contributors
98
55
29
20
16
Categories
176
166
98
69
60
Platforms
251
64
48
27
3
Products / Services
80
72
50
31
29
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
7
IDS Classtypes
29
2
1
IDS Protocols
27
2
1
1
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard. Specifically, it looks for PowerShell commands initiated by explorer.exe that contain 'Get-Clipboard', 'iwr' (Invoke-WebRequest), or 'iex' (Invoke-Expression).
Detects Windows Terminal (wt.exe) spawning PowerShell with specific command-line arguments, typically indicative of user-pasted malicious commands from ClickFix fake update lures linked to Rapid Brigantine.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe, a technique used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
Identifies the execution of a Node.js binary from the C:\ProgramData directory to execute a JavaScript file. This behavior is consistent with the Lorem Ipsum portable Node.js dropper used in Rapid Brigantine's ClickFix campaign to evade static executable signatures.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard. Specifically, it looks for PowerShell commands initiated by explorer.exe that contain 'Get-Clipboard', 'iwr' (Invoke-WebRequest), or 'iex' (Invoke-Expression).
Detects ClickFix PowerShell payloads
Detects execution of PowerShell scripts associated with ErrTraffic (ClickFix) campaigns. The rule identifies malicious patterns, including the use of hex-encoded XOR operations, specific browser update comment markers, and the dynamic creation of ScriptBlocks to facilitate payload execution.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects the execution of 'rundll32' attempting to load 'installer.dll' and invoke its 'Begin' export function. This activity is often associated with malware, specifically the Clickfix campaign, which uses PowerShell's 'Invoke-WebRequest' to download the DLL.
Detects network connections or DNS queries to ErrTraffic Beer cluster domains impersonating AI platforms (ChatGPT, Google Antigravity) delivering DanaBot/HijackLoader via BSOD or reCAPTCHA ClickFix lures, and subsequent browser-spawned PowerShell execution.
Detects instances where browser processes (Chrome, Edge, Firefox) directly spawn PowerShell or MSHTA. This is a behavioral indicator of the 'ClickFix' social engineering technique, where victims are tricked into copying and pasting malicious commands into a terminal, often presented as 'fixes' for fake browser error messages or verification prompts.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects instances of PowerShell being launched directly by explorer.exe. This activity is a known indicator of 'ClickFix' or similar social engineering campaigns, where users are instructed by a deceptive website or lure to copy and paste malicious PowerShell commands into the Windows Run dialog or the File Explorer address bar to execute code.
This rule detects the execution of PowerShell commands or script blocks that contain specific de-obfuscation patterns associated with the ErrTraffic/ClickFix malware. It looks for the presence of '-bxor' and '[convert]::ToInt32' within PowerShell command lines or script blocks, indicating an attempt to decode obfuscated content.
Page 11 of 16