Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
317 detections
Filters
Last updated
All Time
Detection languages
126
70
32
24
23
Contributors
98
55
29
20
16
Categories
176
166
98
69
60
Platforms
251
64
48
27
3
Products / Services
80
72
50
31
29
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
7
IDS Classtypes
29
2
1
IDS Protocols
27
2
1
1
Detects the execution of mshta.exe fetching a .7z payload from a remote URL, as observed in ClickFix campaigns delivering AnimateClipper.
Identifies network connections to known C2 and dropper infrastructure associated with the Amatera Stealer 4.0.2 Beta and ClickFix campaign. Network indicators provide a reliable detection mechanism for compromised hosts attempting to download secondary payloads or exfiltrate data.
Detects the ClickFix paste-and-run initial-access primitive used by KongTuke and other groups. This involves `explorer.exe` spawning PowerShell with defense-evasion arguments (`-NoProfile`, `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`) and a downloader chain targeting cloud file-sharing services. The combination of `explorer.exe` parent (user typing into Run dialog), hidden execution flags, `Invoke-WebRequest`, and `Expand-Archive` in one command line is the defining fingerprint of the technique.
Detects suspicious command line interpreters or downloaders stored in the Windows RunMRU registry key. This technique is often used in ClickFix attacks where users are socially engineered into pasting malicious commands into the Windows Run dialog.
Detects LOLBins (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, etc.) spawned
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.
ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.
The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.
The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
Rule looking for explorer and the user activity Reg Key indicating interactive commands, along with several malicious indicators around "clickfix" campaigns
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Detects execution of a base64 decoded payload piped directly into the zsh shell. This technique is highly indicative of ClickFix social engineering campaigns, where users are manipulated into copying and pasting malicious one-liners into their macOS terminal to bypass Gatekeeper and execute malware such as AMOS.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Detects the execution of msiexec.exe to download and install packages from remote locations. This activity is frequently observed in LeakNet ClickFix campaigns where users are tricked into copying and pasting malicious commands via fake verification prompts.
Detects 'msiexec.exe' being launched from a web browser with a command line containing indicators of remote package download or path traversal. This is a primary indicator of the 'ClickFix' social engineering technique used by LeakNet and other threat actors.
Detects the use of "net.exe" to mount a remote WebDAV share, where the command is recorded in the Explorer RunMRU registry key. This technique was observed in a recent ClickFix campaign for initial access.
Detects the creation or modification of "app.asar" files, which are archives used by Electron-based applications. Adversaries can replace this file in a legitimate, signed application to execute malicious code, as seen in a recent ClickFix campaign trojanizing the WorkFlowy application.
Detects the presence of the unique 'ic-tracker-js' ID within script tags on web server files (.php, .html, .js), which is a high-fidelity indicator of a compromised WordPress site by the IClickFix framework. This rule looks for file creation or modification events where the initiating process command line contains the malicious string.
Detects PowerShell processes launched by Windows Explorer, which is characteristic of a user executing a command from the 'Run' dialog (Win+R). The detection targets command lines associated with the "ClickFix" social engineering technique, which tricks users into running malicious code. This includes looking for encoded commands or specific strings from the "reCAPTCHA Phish" toolkit.
This rule identifies network connections or BITS transfer jobs targeting specific IP addresses and URLs associated with recent ClickFix campaigns. It also detects the use of system utilities like bitsadmin.exe and powershell.exe to download files, a common tactic for these threats.
Detects the execution of a PowerShell one-liner with obfuscation techniques characteristic of the MIMICRAT ClickFix campaign. This campaign tricks users into pasting a command that uses string manipulation and arithmetic to reconstruct and execute a malicious payload.
Page 13 of 16