Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
13
10
5
4
3
Contributors
35
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
14
13
4
3
3
Products / Services
5
5
4
3
3
MITRE Techniques
9
8
6
5
5
CVEs
3
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects sign-ins from the same user account occurring from two different countries within a short time window, where the implied travel velocity exceeds physically achievable speeds, indicating impossible travel or anomalous geolocation change consistent with a hijacked account or API key credential, with special attention to sudden access from China-based infrastructure.
Detects correlated SMOKE#SCREEN activity where a victim host is served a fake Zoom/Flash update lure, an HTTP response containing a JavaScript auto-download trigger, and a Dropbox-hosted payload link, all within the same hourly window.
Detects an APK file written to disk by a browser process within 15 minutes of that browser visiting a non-standard landing page, consistent with CaptiveCrunch/ClickFix Android APK delivery.
Detects DNS resolution of Microsoft-lookalike doppelganger domains within 60 seconds of an HTTP redirect on the same host/session, consistent with CaptiveCrunch captive-portal hijacking.
Detects a browser-spawned explorer.exe chain launching powershell.exe, cmd.exe, mshta.exe, or rundll32.exe with both base64/obfuscation indicators and fake-update/support-dialog keywords in the command line, consistent with ClickFix-style social engineering.
Detects execution/creation of the fake Zoom update installer (ZoomUpdateInstaller.pkg) on macOS endpoints correlated with a network connection to the SMOKE#SCREEN campaign relay IP 207.174.0.143 on port 8080.
Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Page 2 of 2