Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
49
Contributors
37
11
1
Categories
8
7
7
5
5
Platforms
20
11
7
5
5
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
20
11
10
8
7
CVEs
3
1
Detects the Gatekeeper-bypass sequence used by AmnesiaStealer's dropper: chmod +x, ad-hoc codesign (--sign -), and xattr -cr run together against a recently staged binary to defeat quarantine and code-signing checks before execution.
Detects silent theft of Apple Notes data via sudo -S cat against NoteStore.sqlite and its -wal/-shm companions from a non-Notes-app process, a technique AmnesiaStealer uses to avoid triggering a TCC prompt.
Detects cleartext storage of a phished password to a hidden dotfile (~/.pwd) or staging directory by a non-standard process, matching AmnesiaStealer's practice of persisting captured credentials to disk for reuse throughout its collection chain.
Detects selective copying of Telegram tdata account directories (matching the 's'-suffix naming convention while skipping emoji/user_data folders) by a non-Telegram process, matching AmnesiaStealer's Telegram session-theft routine.
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Detects ClickFix-style clipboard/paste-and-run execution: PowerShell, PowerShell ISE, mshta, or cmd spawned from the Windows Run dialog (explorer.exe/RunMRU) with IEX/Invoke-Expression/DownloadString/FromBase64String or mshta HTTP(S) invocation, consistent with the UNC5142 ClickFix lure delivering the DeviceManager RAT.
Detects a spoofed 'Installer wants to make changes' password prompt dispatched from an unsigned or ad-hoc-signed process, used by AmnesiaStealer to phish the victim's macOS login/keychain password.
Detects a filtered document sweep of Desktop, Documents, and Downloads by sensitive file extensions (including wallet and key files) performed by a single non-standard process, matching AmnesiaStealer's document harvesting routine.
Detects an embedded AppleScript using Finder's 'duplicate' command to copy Safari cookies, Notes attachments, and the Keychains folder to a randomly named staging directory, avoiding direct TCC prompts as used by AmnesiaStealer.
Detects shell history clearing (history -c) correlated with deletion of temp-directory files tied to a recently executed unsigned binary, matching AmnesiaStealer's anti-forensic cleanup step.
Detects correlated host and geolocation reconnaissance (sw_vers, whoami, ioreg, system_profiler) executed in quick succession by a non-standard process and written to a system_info.json file, matching AmnesiaStealer's recon routine.
Detects a LaunchDaemon plist named to impersonate Apple's crash reporter, staged at /tmp/starter before being moved into /Library/LaunchDaemons and bootstrapped via launchctl, matching AmnesiaStealer's persistence mechanism.
Detects a browser-triggered 'Allow this website to open Script Editor?' permission prompt, the initial step AmnesiaStealer uses to enable AppleScript-based execution outside the browser sandbox.
Detects rapid enumeration of browser extension storage (Local Extension Settings, IndexedDB) across multiple profiles by a non-browser process, matching AmnesiaStealer's generic cryptocurrency wallet-harvesting technique.
Detects staging and archiving of collected data via ditto -c -k --sequesterRsrc into a randomly named /tmp directory, producing both the main archive and its AppleDouble-style companion zip, matching AmnesiaStealer's pre-exfiltration staging step.
Detects HTTP requests using JWR's e-commerce integration masquerade, where a base64-encoded 's' parameter carries harvested card data or a 'cart_data' parameter resolves to a non-Shopify checkout domain used to spoof the WebSocket C2 origin.
Correlates DNS/network requests to newly observed domains matching JWR's brand-plus-suffix generation pattern across .top/.cfd/.info/.cc TLDs, requiring multiple distinct hostnames sharing the same brand token within a short window to flag likely batch-registered phishing infrastructure.
Detects creation of a scheduled task named 'IntelSoftwareUpdater' via schtasks.exe that launches pythonw.exe with run.pyw, used by the UNC5142 DeviceManager RAT for persistence, relaunching every 10 minutes.
Detects DNS/HTTP beaconing to known OnyxC2 domains or suspicious top-level domains (.top, .cyou, .lol, .online) initiated by a non-browser or newly-created process, plus correlated network-IDS alerts.
Correlates network connections to known OnyxC2 C2/delivery domains and Cloudflare-fronted IPs with the malware's sideloaded-process indicators to detect delivery and command-and-control traffic.
Detects the DeviceManager RAT (run.pyw, spawned via python.exe/pythonw.exe) launching PowerShell or cmd with encoded/obfuscated arguments (-enc, -EncodedCommand, -e, -nop, -w hidden), consistent with C2-tasked arbitrary command execution.
Page 2 of 3