Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
317 detections
Filters
Last updated
All Time
Detection languages
126
70
32
24
23
Contributors
98
55
29
20
16
Categories
176
166
98
69
60
Platforms
251
64
48
27
3
Products / Services
80
72
50
31
29
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
7
IDS Classtypes
29
2
1
IDS Protocols
27
2
1
1
Detects common shell or script processes spawned by explorer.exe, which may indicate execution via the Windows Run dialog. This behavior aligns with ClickFix social engineering techniques and checks for suspicious command-line arguments tied to this pattern, often used to download or execute malicious code.
Detects suspicious command lines executed via the Windows Run dialog that combine DNS lookup commands commonly seen in ClickFix-style staging activity.
An expansion of https://detections.ai/rules/019c774e-8cbc-70b0-91d6-3d2fb93c5a00
An expansion of https://detections.ai/rules/019c774e-8cbc-70b0-91d6-3d2fb93c5a00
Detects a command-line pattern where nslookup is used to query a DNS server, and its output is piped to other commands to parse and execute a payload. This is a technique used by ClickFix campaigns to deliver malware via DNS.
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
Detects ClickFix PowerShell payloads
Using a variety of known Command Patterns and Fake Messages
Using a variety of known Command Patterns and Fake Messages
Detects the use of msiexec.exe to install a package from a remote URL that contains keywords associated with fake verification or captcha lures. This technique is used by threat actors in "Fake Captcha" campaigns to bypass script-based detections.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
The goal of this detection is to alert on activity associated with the ClickFix social engineering technique, where a user is coerced into manually executing attacker-controlled commands via the Windows Run dialog after interacting with a malicious website reached through a phishing email. More details can be found in the reference URL linked below
Detects the execution of SyncAppvPublishingServer.vbs with a command line containing a semicolon, which is indicative of the ClearFake malware campaign's ClickFix technique. This technique abuses SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands, often delivered via social engineering involving malicious copy-paste actions.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
Detects the execution of PowerShell or VBScript commands that contain indicators of base64 encoding. This is a common obfuscation technique used by malware like DarkGate to hide malicious payloads, often seen in social engineering campaigns like "ClickFix".
Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.
This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,
which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.
The clipboard content usually contains commands that download and execute malware, such as information stealing tools.
This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,
which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.
The clipboard content usually contains commands that download and execute malware, such as information stealing tools.
Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.
Detects powershell.exe execution from non-standard parent processes or atypical file system locations, a behavior often associated with ClickFix social engineering attacks.
Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).
Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
Page 14 of 16