Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,808
9,795
6,757
4,421
3,770
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects the malicious 'PDF Viewer' extension (bridged via the com.microsoft.runedge native-messaging helper) requesting both cookie-access and clipboard-access permissions together — the specific combination Jewelbug uses for session-token theft and cryptocurrency address swapping.
Detects non-interactive PowerShell invoked via the Sysnative path with -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -, reading attacker commands from standard input, spawned by a process that is not a known RMM/patch-management agent and is unsigned, low-integrity, or itself suspicious — matching ACRStealer's follow-on command execution.
Detects RtkNGUI64.exe creating a mutex named as an 8-character hex string, consistent with the backdoor's CRC-32(USERNAME+USERDOMAIN+COMPUTERNAME) per-victim beacon ID used for single-instance checking.
Requires the 'Realtek'-named WMI object AND (the 19:50 time-trigger query pattern OR the RtkNGUI64.exe destination) together, rather than matching on the name alone -- avoids flagging unrelated benign WMI objects that happen to share the name.
Detects correlated host and geolocation reconnaissance (sw_vers, whoami, ioreg, system_profiler) executed in quick succession by a non-standard process and written to a system_info.json file, matching AmnesiaStealer's recon routine.
Detects a LaunchDaemon plist named to impersonate Apple's crash reporter, staged at /tmp/starter before being moved into /Library/LaunchDaemons and bootstrapped via launchctl, matching AmnesiaStealer's persistence mechanism.
Detects endpoint network connections to the JWR phishing framework's static WebSocket path and worker script, used to carry AES-256-CTR encrypted exfiltration payloads via the JwrCrypto module.
Detects the NetworkShareScanner SMB/USB worm by known hash or by unsigned-executable propagation to remote shares/removable drives.
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
Detects an AutoIt3.exe/OptiDrive.exe process performing WMI sandbox-fingerprinting queries (Win32_DiskDrive, Win32_VideoController) followed within 15 minutes by access to browser credential files, consistent with ACRStealer's anti-analysis check preceding data collection.
Detects RtkNGUI64.exe creating or writing to tempcache.tmp during command-output staging, scoped to direct process attribution. The rename-away leg of this file's lifecycle is covered by the separate put-command drop-and-rename detection.
Consolidated detection for RtkNGUI64.exe spawning cmd.exe to execute CMD= tasking (SYSTEM/PUT/TIME verbs). Merges two previously separate rules that detected the same underlying signal via different tasking-mechanism angles.
Detects browser-side storage artifacts (JWRCID, JwrExecutedInstructions, JwrCvvForm) persisted by the JWR phishing kit in a victim's browser session/local storage.
Detects a browser-triggered 'Allow this website to open Script Editor?' permission prompt, the initial step AmnesiaStealer uses to enable AppleScript-based execution outside the browser sandbox.
Detects rapid enumeration of browser extension storage (Local Extension Settings, IndexedDB) across multiple profiles by a non-browser process, matching AmnesiaStealer's generic cryptocurrency wallet-harvesting technique.
Detects staging and archiving of collected data via ditto -c -k --sequesterRsrc into a randomly named /tmp directory, producing both the main archive and its AppleDouble-style companion zip, matching AmnesiaStealer's pre-exfiltration staging step.
Detects CoolClient's data-collection module: co-occurring keylogging hook installation, clipboard access, and Chromium credential-store file access from an unsigned/non-OS-vendor process.
Detects the LockScreen component blocking user input and displaying a full-screen StopAndProtect ransom note referencing Telegram/BTC payment.
Detects the fake, undersized RtkNGUI64.exe exiting without reading C:\ProgramData\desktop.ini. Scoped by file size to the known 12,288-byte backdoor binary -- the legitimate, much larger signed Realtek Audio Console also never reads that file, so without this filter every normal launch of the real app would match.
Detects Microsoft Defender exclusions added via wmic/MSFT_MpPreference for a fake Windows Defender installation directory used to shelter CoolClient components.
Detects HTTP requests using JWR's e-commerce integration masquerade, where a base64-encoded 's' parameter carries harvested card data or a 'cart_data' parameter resolves to a non-Shopify checkout domain used to spoof the WebSocket C2 origin.
Page 3 of 9