Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects OptiDrive.exe sweeping multiple browser credential/cookie store files (Local State, Login Data, Cookies, History) across at least 3 distinct files within a 2-minute window, consistent with ACRStealer's browser credential harvesting.
Detects the ACRStealer BYOVD driver's ungated IOCTL 0x2205c0 being sent to \\.\DCRCVDRV_U by a non-management process, correlated within 2 minutes with termination of a security/EDR process, indicating kernel-level defense evasion via the vulnerable driver.
Detects a victim's WhatsApp Web session being abused to automatically propagate ClickFix lure links to contacts, correlated with recent infection indicators.
Detects the StopAndProtect two-stage PowerShell chain: stage 1 downloads/executes stage 2, which reflectively loads a base64-encoded .NET assembly and invokes an Execute method.
Detects the Gatekeeper-bypass sequence used by AmnesiaStealer's dropper: chmod +x, ad-hoc codesign (--sign -), and xattr -cr run together against a recently staged binary to defeat quarantine and code-signing checks before execution.
Detects silent theft of Apple Notes data via sudo -S cat against NoteStore.sqlite and its -wal/-shm companions from a non-Notes-app process, a technique AmnesiaStealer uses to avoid triggering a TCC prompt.
Detects cleartext storage of a phished password to a hidden dotfile (~/.pwd) or staging directory by a non-standard process, matching AmnesiaStealer's practice of persisting captured credentials to disk for reuse throughout its collection chain.
Detects selective copying of Telegram tdata account directories (matching the 's'-suffix naming convention while skipping emoji/user_data folders) by a non-Telegram process, matching AmnesiaStealer's Telegram session-theft routine.
Detects persistence established via a Run registry key named 'Rapid' or 'TIEmounter' pointing to C:\ProgramData\Rapid\creator-ws.exe, correlated with the corresponding process launch, matching ACRStealer's second-stage payload persistence mechanism.
Detects creation of a zero-byte C:\ProgramData\desktop.ini by RtkNGUI64.exe, the crash artifact left behind when the implant's config has not been staged on a host.
Detects the unsigned/untrusted DLL tbbmalloc.dll being side-loaded by pgocvt.exe from C:\ProgramData\TIEmounter\, matching ACRStealer's second payload-set DLL side-loading technique.
Detects installation/loading of the DCRCVDrv.sys BYOVD driver at the atypical staging path C:\Windows\Temp\DCRCVDrv.sys — including SCM service registration, \Device\DCRCVDRV_U device/symlink creation, and named kernel share-event objects — distinguishing attacker deployment from a legitimate DLP install.
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Detects RtkNGUI64.exe being launched via a WMI consumer using the 8.3 short-path form (Progra~1\Realtek\Audio), the same masquerading binary used for backdoor persistence.
Detects ClickFix-style clipboard/paste-and-run execution: PowerShell, PowerShell ISE, mshta, or cmd spawned from the Windows Run dialog (explorer.exe/RunMRU) with IEX/Invoke-Expression/DownloadString/FromBase64String or mshta HTTP(S) invocation, consistent with the UNC5142 ClickFix lure delivering the DeviceManager RAT.
Detects a non-browser process reading browser session-cookie databases or 2FA/authenticator extension local storage across 200+ targeted apps, consistent with OnyxC2's MFA-bypass and account-takeover capability.
Detects a browser-triggered 'Allow this website to open Script Editor?' permission prompt, the initial step AmnesiaStealer uses to enable AppleScript-based execution outside the browser sandbox.
Detects a spoofed 'Installer wants to make changes' password prompt dispatched from an unsigned or ad-hoc-signed process, used by AmnesiaStealer to phish the victim's macOS login/keychain password.
Detects a filtered document sweep of Desktop, Documents, and Downloads by sensitive file extensions (including wallet and key files) performed by a single non-standard process, matching AmnesiaStealer's document harvesting routine.
Detects an embedded AppleScript using Finder's 'duplicate' command to copy Safari cookies, Notes attachments, and the Keychains folder to a randomly named staging directory, avoiding direct TCC prompts as used by AmnesiaStealer.
Detects shell history clearing (history -c) correlated with deletion of temp-directory files tied to a recently executed unsigned binary, matching AmnesiaStealer's anti-forensic cleanup step.
Page 2 of 9