Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects the Abyssos HVNC_CLONE_START to GRABCOOKIES to cookie-injection chain: browser profile/cookie staging under a temp fontconfigs folder correlated with a non-browser process connecting to a local Chrome/Edge/Brave remote-debugging port (9222) used for Network.setCookie session hijacking.
Detects extraction and execution of OnyxC2 lure archives (Setup_File*.zip, Fling-Standalone*.zip) via WinRAR/7-Zip from a Downloads/Temp directory, correlating the archive-open with the lure-named installer executing shortly after.
Matches endpoint file/process hashes and network IPs against a curated, freshness-checked OnyxC2 indicator feed.
Detects a multi-hop HTTP redirect chain traversing two or more known OnyxC2 phishing lure domains from the same host within a two-minute window, consistent with the redirect obfuscation used before final payload delivery.
Detects a cmd.exe process spawned as a direct child of a process that just established an outbound connection to a public IP, excluding common RMM/remote-support tools — consistent with Abyssos's C2CMD interactive reverse-shell capability.
Detects correlated host-profiling reconnaissance by the DeviceManager RAT: three or more distinct indicators (MachineGuid, volume serial, user SID, AV product enumeration, domain/workgroup enumeration) executed within a 15-minute window from the same python.exe/pythonw.exe parent process.
Detects a renamed AutoHotkey interpreter executable (masquerading as another binary via its version-info OriginalFileName field) running from a Temp, Downloads, or AppData folder with no command-line arguments and a co-located, same-named .ahk script file created within an hour, consistent with the AutoHotkey stager technique used by UNC6692 to deploy the Edgecution malware suite.
Detects the ClickFix-style social engineering technique used in the UNC6692 campaign where a victim, prompted via fake 'Outlook Version Verification' / 'OS Version Verification' buttons on a phishing page, is coerced into pasting a clipboard-copied batch or PowerShell script into the Windows Run dialog for execution.
Detects python.exe/pythonw.exe executing compiled bytecode (.pyc/.pyz) from a non-standard installation path (excluding venv/site-packages/Program Files) with an outbound connection to a non-standard port within 5 minutes, consistent with DeviceManager RAT execution.
Detects IOCTL communication with the msagent.sys rootkit driver's device object from an unsigned or non-standard-path process, indicating rootkit configuration/control activity.
Flags modifications to the Windows hosts file made by an unsigned process or a process freshly dropped in a temp folder within the last 10 minutes, consistent with Abyssos's DNS_ADD/DNS_DEL hosts-file manipulation.
Correlates AES-CBC shellcode decryption (EXECURL_AES_HOL/EXECLOCAL_AES_HOL/AESHOL) with a preceding external download and a full VirtualAllocEx-WriteProcessMemory-CreateRemoteThread injection sequence into a named target process within 1 hour.
Detects AiTM reverse-proxy pages injecting the ServerData=$Config script alongside a redirUrl/api.country.is capture script and a rewritten login.microsoftonline.com authorize path hosted on a non-Microsoft domain, used to steal OAuth2 session tokens and bypass MFA.
Detects an encrypted/unsigned file download immediately following execution of a known OnyxC2 install-lure process (Setup_File*/Fling-Standalone* or a known lure hash), consistent with the AES-256-encrypted build/payload retrieval used to evade network content inspection.
Detects file access/modification/creation events targeting .env files or browser credential storage artifacts, combined with process command lines referencing API_KEY/TOKEN alongside environment-variable access patterns, indicative of infostealer malware harvesting developer secrets and browser-stored credentials, followed by an outbound network connection consistent with exfiltration.
Detects the Abyssos UAC_BYPASS_ICMLUAUTIL technique: a process referencing the ICMLuaUtil COM interface/CLSID that ends up running at High/System integrity without going through consent.exe.
Detects creation of a mutex matching Abyssos's Global\[UUID4]_Admin/_User single-instance naming convention, or the specific known hardcoded mutex GUID.
Detects python.exe binding a loopback listener on port 8000, 8001, or 8002 and then spawning cmd.exe or powershell.exe within 5 minutes of the listener being established, consistent with SNOWBASIN Python bindshell behavior observed in the UNC6692 Edgecution campaign.
Detects the Edgecution native messaging host chain where a batch wrapper (native_host.bat), spawned by msedge.exe, launches python.exe with the unbuffered output flag (-u) to run the malicious native_host.py backend used for C2 command execution.
Detects npm install/ci/postinstall or publish process activity correlated within a short time window to outbound network connections toward destinations that are not on the known-safe npm registry/CDN allowlist and are not recognized internal mirrors, indicative of malicious npm packages (Shai-Hulud/Miasma) exfiltrating tokens/credentials or beaconing to attacker infrastructure during package install or propagation.
Detects the ClickFix pattern of a clipboard copy event followed within 5 seconds by an encoded/base64 mshta.exe or powershell.exe execution, consistent with DOUBLECUP's clipboard-hijacking lure.
Page 6 of 9