Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
20
15
4
3
Contributors
42
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
25
14
2
1
1
Products / Services
14
6
4
4
3
MITRE Techniques
15
13
6
5
5
CVEs
4
3
3
1
Detects Linux persistence and removal activity by the botking implant, systemd user-service creation with the 'System Config User Service' description marker, secondary symlink persistence, or systemctl --user enable/disable for install/removal.
Flags direct registry staging of a Boot Bus Extender service (SERVICE_SYSTEM_START) whose Args value contains ':changelist', bypassing the Service Control Manager, where the driver image lies outside the Defender platform folder or uses a randomized 8-character filename — the SCM-bypass pattern used to stage BTR.sys for boot-time or immediate execution.
Detects creation of a macOS LaunchAgent plist referencing a suspicious temp path or unrecognized vendor bundle identifier, consistent with the botking implant's macOS persistence mechanism.
Detects creation of an HKCU Run key value whose data references a temp or AppData temp path, consistent with the Windows persistence step of the botking implant after the build-time payload drop.
Detects the full process-hollowing sequence (suspended process creation, SetThreadContext, ResumeThread) executed against the same target PID for wab.exe or MSBuild.exe within a short window — the ACRStealer campaign's injection technique.
Detects the AmnesiaStealer TCC-bypass chain: correlated Time Machine local snapshot creation/mounting (recycling CVE-2020-9771), hidden snapshot marker files, and direct SQLite injection into a mounted TCC.db copy to grant Full Disk Access, followed by killing tccd to force a reload.
Detects the BYOVD kill chain for the DCRCVDrv.sys driver: drop to C:\Windows\Temp\, DCRCVDRV_U/LEGACY_DCRCVDRV_U service installation, device open, and IOCTL 0x2205c0 invocation used to terminate security/EDR processes from kernel context.
Detects the Screen Sharing file-copy helper (SSFileCopySender/SSFileCopyReceiver) running as UID 0/GID 80 while the connected session user is non-root/non-admin, indicating abuse of the arbitrary root file read/write primitive.
Static file-based detection of the ACRStealer dropper, encrypted AutoIt payload, and DCRCVDrv.sys BYOVD driver via filenames, service/device names, signer names, and certificate serial. Certificate/signer matches only fire in combination with the driver file or service artifacts to avoid flagging the legitimate vendor certificate alone.
Detects a root-privileged child process spawned from screensharingd with no corresponding authorization/sudo prompt, indicating privilege escalation via the post-auth logic flaw CVE-2026-43760.
Detects successful SYSTEM-level privilege escalation via the ShieldBreak exploit, which bypasses the fix for CVE-2026-50656 (RoguePlanet) on fully patched Windows 10, 11, and Server 2025 systems while Microsoft Defender is enabled. Fires when ShieldBreak.exe spawns cmd.exe running as NT AUTHORITY\SYSTEM with a whoami/system confirmation, correlated with Defender activity on the host within a 5-minute window.
Detects static file artifacts bundled with the publicly released ShieldBreak Microsoft Defender exploit kit
Detects a root-privileged child process of screensharingd with no corresponding TCC daemon activity on the host, indicating a TCC-bypassing privilege escalation via the pre-auth vulnerability.
Detects CoolClient process injection into a suspended synchost.exe instance via remote thread creation and thread-context redirection.
Detects the correlated sudoers-based privilege escalation chain: a non-root user writing a root-owned sudoers.d policy via the Screen Sharing file-copy channel, followed by passwordless sudo execution, followed by an outbound network connection as root within bounded time windows.
Detects access-token duplication combined with CreateProcessAsUserA spawning the non-standard synchost.exe process outside System32 under a target interactive session.
Detects Windows Defender process-level interaction consistent with the ShieldBreak exploit: MsMpEng.exe spawning an unexpected child process (excluding known-legitimate Defender helpers), or Defender's on-access scanner being triggered against unusual globalroot\BaseNamedObjects object-manager paths instead of normal filesystem paths.
Detects msagent.sys driver load correlated with subsequent protection (reduced handle access rights) of an unsigned, non-standard synchost.exe process within a 1-hour window.
Detects a shell spawned by Claude.app or Cursor.app with the --allow-dangerously-skip-permissions flag, indicating the coding agent's safety/permission prompts have been bypassed, widening the blast radius of subsequent agent-driven commands.
Detects the full technical staging sequence unique to the ShieldBreak CLFS time-of-check-to-time-of-use (TOCTOU) technique: cloud provider registration, WD_TARGET/WD_SHADOW object-manager directory creation, WD_SCAN object-link creation under the normal and CLFS namespaces, ntdll.dll copy into a BERLIN alternate data stream, the link-deletion/CLFS-log-lock race sequence, and the final phoneinfo.dll:stream lock confirming the file-overwrite primitive succeeded.
Detects accounts authenticating from compromised webmail/CMS infrastructure that pivot, within a tight time window and matching source IP, to authenticate against internal virtualization-management systems — the lateral-movement pattern Jewelbug used to reach a national webmail estate's backing infrastructure.
Page 1 of 2