Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
29
5
5
4
3
Contributors
47
Categories
20,445
11,833
5,875
5,151
4,864
Platforms
40
3
2
2
1
Products / Services
22
8
6
2
2
MITRE Techniques
28
19
14
14
12
CVEs
7
1
1
IDS Classtypes
1
IDS Protocols
1
Detects a privileged/elevated AI-agent tool invocation whose arguments are sourced from sandbox runtime output within 30 seconds of a PBKDF2/AES decrypt event, with no provenance tag distinguishing that output from trusted state — the generic post-decryption privileged-action sequence behind Cryptographic Context Injection attacks.
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Detects C2Looper sideloading a malicious wtsapi32.dll from a non-System32 path by terminating and relaunching the legitimate OneDrive.exe process to load it.
Detects a process other than screensharingd binding to macOS Screen Sharing port 5900 shortly after being newly spawned, indicating potential exploitation of the CVE-2026-43779 connection-interception logic flaw.
Detects C2Looper sideloading a malicious wtsapi32.dll from a non-System32 path by terminating and relaunching the legitimate OneDrive.exe process to load it.
Detects screensharingd or its child helper processes accessing TCC-protected data categories on hosts with no prior TCC grant recorded for screensharingd, indicating a TCC bypass via the Screen Sharing exploit chain.
Detects a Windows Error Reporting (WER) crash report for MsMpEng.exe whose fault signature matches the ShieldBreak exploit crash pattern, indicating the Defender process crashed as a byproduct of the TOCTOU exploitation attempt. Excludes routine crashes tied to signature/platform updates.
Detects loading of Warden.dll — the Defender-bypass component of the ShieldBreak exploit — when unsigned or not signed by Microsoft, excluding legitimate signed Defender platform update binaries.
Detects C2Looper injecting shellcode into the legitimate winspool.drv module via a remote thread, excluding legitimate print subsystem processes.
Detects C2Looper injecting shellcode into the legitimate winspool.drv module via a remote thread, excluding legitimate print subsystem processes.
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Detects ntdll.dll being copied into an alternate data stream at a ShieldBreak-specific staging path, used to prepare the overwrite of a protected system DLL. Excludes legitimate backup, imaging, and EDR/forensic tooling that streams or duplicates system DLLs.
Detects presence of the EICAR AV test file only when co-occurring with ShieldBreak exploit artifacts (PoC binary, build files, or Warden.dll) in the same directory or process context, indicating exploit development/testing activity rather than routine AV testing.
Detects network access to known repositories hosting the publicly disclosed ShieldBreak Microsoft Defender zero-day bypass PoC/tooling (GitHub, Project Nightcrawler, Church of Malware mirrors) via HTTP host/URI or TLS SNI matching.
Detects the ShieldBreak Defender-scan TOCTOU exploit locking an alternate data stream on the protected system DLL phoneinfo.dll immediately prior to an arbitrary write — the core privilege-escalation primitive of CVE-2026-50656. Excludes legitimate Windows Update/servicing operations.
Detects an AI agent's code-execution sandbox decrypting attacker-supplied AES/PBKDF2 ciphertext immediately after fetching untrusted external content — the core trust-laundering mechanism behind Cryptographic Context Injection attacks.
Detects a process reporting the display name TVHelper whose backing executable is actually libdevice.so or another binary outside standard OEM app directories, consistent with Kimwolf v7 relabeling its payload as the legitimate Android TV helper service to evade casual process-list review.
Detects creation of restricted object manager namespace objects (WD_TARGET_/WD_SHADOW_/WD_SCAN) used to hijack Microsoft Defender's on-access scan target as part of the ShieldBreak exploit, excluding objects created by signed Microsoft/Defender processes.
Detects a process reporting the name netd_service whose backing executable path does not match genuine Android system netd binary locations, indicating Kimwolf v7 process masquerading to blend into legitimate network daemon activity.
Detects creation of an abstract Unix domain socket matching the Kimwolf v7 single-instance mutex naming convention (@*boxv7/@*boxv4/@*boxv5) by a process running from a non-system, application-data path.
Detects the STAC4749 malicious vcruntime140_1.dll sideloaded via trojanized CopyQ binary, communicating with imarketads.com and launching sekv*.exe loader
Page 1 of 3