Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
317 detections
Filters
Last updated
All Time
Detection languages
126
70
32
24
23
Contributors
98
55
29
20
16
Categories
176
166
98
69
60
Platforms
251
64
48
27
3
Products / Services
80
72
50
31
29
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
7
IDS Classtypes
29
2
1
IDS Protocols
27
2
1
1
Detects outbound HTTP GET/POST requests containing 'event=pasted' in the query string or URL, often directed at paths like '/api/metrics/run'. This pattern is associated with 'ClickFix' or 'AMOS' second-stage beaconing, where an adversary confirms a victim has successfully executed a social-engineered command (e.g., via copy-paste into a terminal) before proceeding with further payload delivery.
Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.
This rule detects HTML content containing common indicators of fake Cloudflare 'Verify you are human' CAPTCHA lure pages associated with the Beamglea/ClickFix campaign. These lures often use typosquatted domains or specific API key patterns and include JavaScript code to facilitate the 'copy-and-paste' execution workflow typical of the ClickFix attack technique.
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
Detects ClickFix-style initial access where a Run-dialog-spawned interpreter (cmd.exe, powershell.exe, mshta.exe, cscript.exe) executes an encoded or obfuscated command line, consistent with clipboard-paste delivery of C2Looper.
Detects the StopAndProtect ClickFix lure: a fake CAPTCHA/human-verification page tricks victims into pasting and running a clipboard-staged PowerShell command (Win+R, Ctrl+V, Enter) that downloads and runs vcapcha.ps1.
Detects ClickFix-style initial access where a Run-dialog-spawned interpreter (cmd.exe, powershell.exe, mshta.exe, cscript.exe) executes an encoded or obfuscated command line, consistent with clipboard-paste delivery of C2Looper.
Detects ClickFix-style clipboard/paste-and-run execution: PowerShell, PowerShell ISE, mshta, or cmd spawned from the Windows Run dialog (explorer.exe/RunMRU) with IEX/Invoke-Expression/DownloadString/FromBase64String or mshta HTTP(S) invocation, consistent with the UNC5142 ClickFix lure delivering the DeviceManager RAT.
No description available.
Detects a sequence of events where a user visits a known ClickFix Traffic Direction System (TDS) domain and subsequently executes an obfuscated 'curl' command via the Terminal application on macOS. This pattern is indicative of a ClickFix campaign where users are socially engineered into pasting malicious code snippets to resolve fake browser errors.
This rule detects when Microsoft Defender SmartScreen identifies and blocks or warns users about access to known 'ClickFix' phishing landing pages. These pages often attempt to social engineer users into executing malicious commands via copy-paste actions (e.g., in a terminal or Run dialog) as a deceptive remediation step for fake browser errors.
Detects the DOUBLECUP/ClickFix loader activity which involves a sequence of suspicious command-line execution patterns. The rule correlates three specific behaviors occurring within a 5-minute window: finding PowerShell paths using 'where', searching for the 'ZZ1984' marker using 'findstr', and executing a minimized background command process. This combination is highly indicative of the ClickFix delivery chain used to trick users into running malicious commands.
Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.
Detects the ClickFix pattern of a clipboard copy event followed within 5 seconds by an encoded/base64 mshta.exe or powershell.exe execution, consistent with DOUBLECUP's clipboard-hijacking lure.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
This rule detects the execution of potentially malicious command-line patterns (involving base64 decoding, pipes to sh/zsh, and network-fetching utilities like curl) within Terminal.app processes on macOS. It correlates these command executions with prior web browser activity within a 5-minute window, effectively identifying potential 'ClickFix' social engineering lures where users are coerced into copying and pasting malicious instructions into their shell.
Detects ClickFix social-engineering attacks where a user is tricked into pasting malicious commands into the Windows Run dialog. The detection monitors explorer.exe spawning cmd.exe or powershell.exe with specific command-line indicators, such as wildcard patterns used to obfuscate powershell.exe names, the 'ZZ1984' marker string associated with DOUBLECUP/ClickFix loaders, or specific loop structures ('for /f') designed to locate and parse payloads staged in browser cache.
Detects the DOUBLECUP ClickFix Stage 1 execution chain where a cmd /c for/f loop searches for powershell.exe via the wildcard pattern 'where pow?r?hell.exe' and pipes through findstr "ZZ1984" to locate and extract the steganographic PNG payload marker before invoking PowerShell.
This rule detects malicious activity associated with the DOUBLECUP/CountLoader malware by correlating specific PowerShell execution patterns within a single process lineage. It flags process sequences where an encoded PowerShell command (using -enc or -encodedcommand) occurs in conjunction with suspicious .NET reflection (System.Reflection.Assembly) or ScriptBlock invocation within a 5-minute window. The rule explicitly excludes processes with valid digital signatures to reduce false positives from legitimate administrative software.
Detects creation of a .lnk file on a removable/non-system drive letter (D: through Z:) whose launching process command line references mshta.exe, consistent with CountLoader's USB-worming propagation technique observed in the DOUBLECUP LaaS campaigns.
Detects the DOUBLECUP ClickFix loader execution chain where cmd.exe uses a 'for /f' loop with 'where pow?r?hell.exe' wildcard lookup, 'findstr' searching for the ZZ1984 marker, and a minimized 'start /min cmd /c' relaunch, consistent with steganographic PNG cache extraction and CountLoader/DeviceManager RAT delivery.
Page 9 of 16