Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
103 detections
Filters
Last updated
All Time
Detection languages
45
36
8
6
4
Contributors
21
16
16
10
5
Categories
82
37
28
19
9
Platforms
99
3
1
1
Products / Services
43
27
20
11
8
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
Detects the creation of specific mutex objects ('AppUpdateHelper' or 'WinSvc') commonly associated with Hidden VNC (hVNC) backdoors. These mutexes are used by the malware to ensure only one instance is running on the host, and the regex pattern targets the specific naming convention (including a hex suffix) utilized by these threats.
Detects the creation of specific mutex objects ('AppUpdateHelper' or 'WinSvc') commonly associated with Hidden VNC (hVNC) backdoors. These mutexes are used by the malware to ensure only one instance is running on the host, and the regex pattern targets the specific naming convention (including a hex suffix) utilized by these threats.
Detects the creation of specific mutex objects ('AppUpdateHelper' or 'WinSvc') commonly associated with Hidden VNC (hVNC) backdoors. These mutexes are used by the malware to ensure only one instance is running on the host, and the regex pattern targets the specific naming convention (including a hex suffix) utilized by these threats.
Detects the execution of an unsigned binary named '.macos' located within a 'Contents/MacOS/' directory structure, which is a common pattern for malicious applications attempting to masquerade or hide their execution profile on macOS.
Detects the creation of specific mutex objects ('AppUpdateHelper' or 'WinSvc') commonly associated with Hidden VNC (hVNC) backdoors. These mutexes are used by the malware to ensure only one instance is running on the host, and the regex pattern targets the specific naming convention (including a hex suffix) utilized by these threats.
Detects the execution of an unsigned binary named '.macos' located within a 'Contents/MacOS/' directory structure, which is a common pattern for malicious applications attempting to masquerade or hide their execution profile on macOS.
Detects Microsoft Edge being launched in a headless state with remote debugging enabled, hidden window dimensions, and a specific temporary user data directory naming convention. This pattern is characteristic of the TWINLOOT technique, where an adversary controls a headless browser via the Chrome DevTools Protocol (CDP) to conduct C2 communications and data exfiltration through legitimate Microsoft Graph API endpoints, effectively blending malicious traffic with normal browser activity.
Detects msedge.exe launched headless (--headless / --headless=new) with CDP remote debugging enabled (--remote-debugging-port=), a temp profile directory matching the launcher-edge- naming pattern, and window flags positioning it off-screen (--window-position=-32000,-32000, --window-size=1,1). This combination matches the TWINLOOT implant's technique of spawning a headless Edge instance with a Chrome DevTools Protocol connection, using the browser's authenticated same-origin session to proxy Microsoft Graph API C2 traffic so it blends in with legitimate browser network activity while remaining invisible on-screen. Excludes known browser-automation/CI framework parent processes and the --enable-automation flag to reduce false positives.
references:
- https://detections.ai/inspirations/01a01ade-da64-7718-8281-426118171583
- https://detections.ai/inspirations/01a01ade-d9a6-742d-8e2f-f60b5efce416
- https://detections.ai/inspirations/01a01ade-da04-700d-ba14-769eef28e475
- https://github.com/ontinue-research/threat-intel-iocs/blob/main/Public/2026-07-27-TWINLOOT-IOCs.md
- https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
references:
- https://detections.ai/inspirations/01a01ade-da64-7718-8281-426118171583
- https://detections.ai/inspirations/01a01ade-d9a6-742d-8e2f-f60b5efce416
- https://detections.ai/inspirations/01a01ade-da04-700d-ba14-769eef28e475
- https://github.com/ontinue-research/threat-intel-iocs/blob/main/Public/2026-07-27-TWINLOOT-IOCs.md
- https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
Detects execution of pythonw.exe (windowless Python) with the LAUNCHER_BG_CHILD=1 environment marker present on the command line alongside TWINLOOT-specific staging marker filenames (.agent.lock, .vendor.ok, .vendor.stamp, .reobf.manifest, client_id.txt). TWINLOOT is a modular Python implant that relaunches itself windowlessly via pythonw.exe, extracts a vendor ZIP, and uses these marker files to track staging state during its bootstrap and PyArmor-protected launcher stages, while abusing Microsoft 365/Azure services for C2.
Detects the execution of Windows Script Host (wscript.exe) where the Interactive mode is explicitly disabled in the script content or command line arguments. Disabling interactive mode is a common technique used by attackers to ensure malicious scripts run silently without triggering UI prompts or requiring user interaction.
Detects the use of curl.exe or curl to communicate with the malicious domain 'i.apee.my.id', initiated by a VS Code integrated terminal process. This behavior is indicative of malicious VS Code extensions exfiltrating data via a hidden terminal session.
Detects the execution of Windows Script Host (wscript.exe) where the Interactive mode is explicitly disabled in the script content or command line arguments. Disabling interactive mode is a common technique used by attackers to ensure malicious scripts run silently without triggering UI prompts or requiring user interaction.
Detects the execution of explorer.exe on an alternate, non-default Windows desktop. This behavior is a common indicator of Hidden VNC (hVNC) attacks where malware creates an isolated, invisible desktop environment to interact with the victim's session remotely and surreptitiously.
Detects the creation of explorer.exe processes on non-default Windows desktops, which is a known indicator of Hidden VNC (HVNC) activity often utilized by the Dolphin X stealer. The rule mitigates false positives by excluding legitimate non-default desktop uses (like RDP/Citrix/VDI brokers) and requires correlation with a recent network connection from the newly spawned explorer.exe process.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
Detects an obfuscated, hidden-window PowerShell loader chaining campaign-specific SET environment-variable assignments to stage a payload path and download a next-stage payload from cdn.zoom-videos infrastructure, consistent with BlueNoroff's ClickFix PowerShell staging technique.
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
Page 2 of 5