Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,181 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects browser extension manifest.json files requesting declarativeNetRequest and content_scripts/host_permissions covering AI assistant vendor domains (BragJack attack class)
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
This rule identifies Linux devices with kernel versions that are vulnerable to CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. It parses the OSBuild field to extract kernel major, minor, and patch version numbers and compares them against known unpatched releases.
Page 272 of 756