Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,808
9,795
6,757
4,421
3,770
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects System-process (PID 4) registry writes or deletions targeting Windows Defender tamper-protection values or Run/RunOnce persistence keys, indicating use of the BTR.sys kernel registry-write primitive to disable protections or establish persistence.
Flags direct registry staging of a Boot Bus Extender service (SERVICE_SYSTEM_START) whose Args value contains ':changelist', bypassing the Service Control Manager, where the driver image lies outside the Defender platform folder or uses a randomized 8-character filename — the SCM-bypass pattern used to stage BTR.sys for boot-time or immediate execution.
Detects Chrome/Chromium processes launched with the --remote-debugging-port flag (optionally combined with --remote-allow-origins or --headless), enabling Chrome DevTools Protocol (CDP) session hijacking as used by AmnesiaStealer's streaming module to remotely control an authenticated browser session. Excludes known automation frameworks (Puppeteer, Playwright, Selenium).
Detects the ClickFix-style Terminal dropper pattern: zsh/Terminal.app spawning bash with a piped base64-decode or curl-download command redirected through nohup, matching AmnesiaStealer's counterfeit GitHub 'Download for macOS' lure page execution chain.
Correlates the hardcoded BootClean.log creation-then-deletion lifecycle (performed by the System process) with a preceding anomalous or hash-matched BTR.sys driver load within a tight time window, reducing the otherwise high false-positive rate of alerting on the log artifact alone.
Detects process command lines matching the documented BTR_CLI.exe flag combinations (-chain/-item, -trigger now|boot, -cleanup) used to orchestrate chained kernel file/registry operations via the BTR.sys primitive.
Detects a randomly-named 8-character .sys file created outside standard driver/staging paths and then loaded from a non-standard user or temp directory shortly after — matching the pattern of BTR.sys being extracted from MpEngine.dll's embedded resource and executed outside its normal location.
Detects the StopAndProtect ClickFix lure: a fake CAPTCHA/human-verification page tricks victims into pasting and running a clipboard-staged PowerShell command (Win+R, Ctrl+V, Enter) that downloads and runs vcapcha.ps1.
Detects msagent.sys kernel driver load events immediately followed by targeted module/filter enumeration (driverquery/fltmc) referencing the same driver.
Detects continuous low-frame-rate screenshot capture activity consistent with AmnesiaStealer's remote visual surveillance of a victim's authenticated browser session during live operator control.
Detects hash-matched BTR.sys driver loads that are validly signed by Microsoft but not initiated by a legitimate Windows Defender platform process (MsMpEng.exe/MpCmdRun.exe or the Defender Platform folder) — indicating the driver is being loaded by an unauthorized process to abuse its kernel-level file/registry operation primitive.
Detects abuse of the macOS `security` CLI to unlock the login keychain and suppress interactive prompts, or to delete/recreate the 'Chrome Safe Storage' keychain entry with an attacker-chosen password, matching AmnesiaStealer's keychain and cookie-decryption technique.
Detects creation of the ':changelist' configuration stream or a feedback (*.dat) stream written onto a .sys driver file itself, distinguishing the abuse pattern (feedback stream on the driver) from legitimate Defender remediation, which writes feedback to a standalone ProgramData path.
Detects wscript.exe executing the VBScript launcher OptiDrive.vbs from the ACRStealer masquerade staging path (%LOCALAPPDATA%\DriveOptimize Technologies\), used to invoke the persistent compiled AutoIt payload.
Detects self-deletion of ACRStealer's first-stage payload artifacts (Proper.a3x / BrowserMetrics) by the same process that recently created a persistence Run key or dropped follow-on files, indicating anti-forensic cleanup after installation.
Detects AutoIt3.exe launched with a .a3x script argument from a %TEMP%\IXP* self-extraction directory, spawned by WEXTRACT.EXE — the ACRStealer first-stage execution chain (setup_patched.exe IExpress self-extractor deploying an encrypted AutoIt payload).
Detects the backdoor's put-command file-drop evasion: RtkNGUI64.exe creates tempcache.tmp then renames it to the target path before patching the corrupted MZ header bytes.
Detects local validation of a phished password via dscl -authonly immediately followed by sudo -S -v in a short time window, matching AmnesiaStealer's technique for confirming captured credentials are valid before reuse.
Detects the AmnesiaStealer TCC-bypass chain: correlated Time Machine local snapshot creation/mounting (recycling CVE-2020-9771), hidden snapshot marker files, and direct SQLite injection into a mounted TCC.db copy to grant Full Disk Access, followed by killing tccd to force a reload.
Detects browser cookie theft via a cloned Chrome profile directory, CDP-based cookie export, and/or SQLite re-encryption of the cookie database using an attacker-known Safe Storage password, as used by AmnesiaStealer's streaming module.
Correlates BTR_CLI arbitrary-write invocations (Action 3) targeting System32\drivers with a resulting file write of a known-malicious hash (e.g., mimidrv.sys) or an unsigned/non-Microsoft-signed binary — detecting the kernel write primitive being used to plant a malicious driver into a protected directory.
Page 1 of 9