Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
317 detections
Filters
Last updated
All Time
Detection languages
126
70
32
24
23
Contributors
98
55
29
20
16
Categories
176
166
98
69
60
Platforms
251
64
48
27
3
Products / Services
80
72
50
31
29
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
7
IDS Classtypes
29
2
1
IDS Protocols
27
2
1
1
Detects instances where explorer.exe spawns cmd.exe or powershell.exe with command-line arguments indicative of obfuscated execution, such as encoded commands, hidden window styles, or bypass flags. This pattern is consistent with ClickFix social engineering attacks where users are deceived into manually executing malicious commands via the Windows Run dialog.
Detects instances where explorer.exe spawns cmd.exe or powershell.exe with command-line arguments indicative of obfuscated execution, such as encoded commands, hidden window styles, or bypass flags. This pattern is consistent with ClickFix social engineering attacks where users are deceived into manually executing malicious commands via the Windows Run dialog.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects network traffic matching a list of known malicious domains and IP addresses observed in CommonSecurityLog events, tightened to reduce noise from scanners/TI feeds, sinkholed infrastructure, and generic reused IPs by requiring domain-specific selectors and deduplicating repeated matches per host.
Detects instances where Windows Explorer (explorer.exe) launches common script interpreters like PowerShell or mshta, often indicative of a 'ClickFix' social engineering attack where a user is coerced into pasting malicious commands into the Windows Run dialog.
Detects ClickFix-style activity where a web browser or common application launcher spawns a terminal or PowerShell process to execute obfuscated, copied, or piped commands. This behavior often indicates a social engineering attack where a user is tricked into manually executing a malicious command script.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
HBO Max ClickFix attacks IOC Hunt
Cortex XDR
Detects network activity (DNS queries or direct IP communication) associated with 'ClickFix' social engineering attacks targeting users under the guise of an HBO Max update or repair utility. The rule includes indicators for known malicious domains and IP addresses while incorporating filters to minimize false positives from security scanners, threat intel feeds, and automated crawlers by analyzing User-Agent strings and network source addresses.
Detects network indicators associated with 'ClickFix' social engineering campaigns. The rules identify connections to known malicious domains and IP addresses involved in serving fake CAPTCHA prompts or error-resolution instructions, as well as the delivery and subsequent transmission of specific overlay cookies ('cookie-captcha-complete') used in these attacks.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
Detects network traffic matching a list of known malicious domains and IP addresses observed in CommonSecurityLog events, tightened to reduce noise from scanners/TI feeds, sinkholed infrastructure, and generic reused IPs by requiring domain-specific selectors and deduplicating repeated matches per host.
Detects network traffic matching a list of known malicious domains and IP addresses observed in CommonSecurityLog events, tightened to reduce noise from scanners/TI feeds, sinkholed infrastructure, and generic reused IPs by requiring domain-specific selectors and deduplicating repeated matches per host.
Detects network traffic matching a list of known malicious domains and IP addresses observed in CommonSecurityLog events, tightened to reduce noise from scanners/TI feeds, sinkholed infrastructure, and generic reused IPs by requiring domain-specific selectors and deduplicating repeated matches per host.
Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.
This rule detects HTML content containing common indicators of fake Cloudflare 'Verify you are human' CAPTCHA lure pages associated with the Beamglea/ClickFix campaign. These lures often use typosquatted domains or specific API key patterns and include JavaScript code to facilitate the 'copy-and-paste' execution workflow typical of the ClickFix attack technique.
Detects suspicious command execution patterns commonly associated with ClickFix-style social engineering attacks. The rule identifies Terminal processes executing shell commands that retrieve remote content via curl, followed by base64 decoding and/or piping directly into a shell interpreter (zsh/sh/bash), which is a common technique for executing obfuscated malicious payloads.
Page 8 of 16