Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
29
5
Contributors
34
Categories
14
6
4
4
3
Platforms
23
12
Products / Services
10,844
9,798
6,760
4,421
3,776
MITRE Techniques
19
12
11
9
7
CVEs
5
4
1
1
Correlation detection for the PureLogs Stealer / fake Adobe Sign campaign. Fires when 3+ of 6 distinct attacker behaviors (Downloads-sourced 'output_*.js' execution via wscript/cscript, UserinitMprLogonScript persistence pointing at a .js payload, PowerShell fileless env-var payload reconstruction via [System.Environment]::GetEnvironmentVariable+IEX, in-memory .NET Assembly.Load without a disk-based .dll/.exe argument, PowerShell-initiated PixelDrain PNG retrieval, and PowerShell-initiated C2 traffic to vm180012.hosted-by.qwins.co) occur on the same host within a 15-minute window. All network/PowerShell legs are scoped to powershell.exe specifically to avoid flagging benign browser traffic to the legitimate PixelDrain file-sharing service.
Detects modifications to the UserInitMprLogonScript registry value that point to suspicious locations or file types (e.g., AppData, .js, .vbs). This registry key is commonly used for persistence by executing a script at user logon. The rule excludes common legitimate paths like NETLOGON or SYSVOL.
Detects a suspicious process chain where 'conhost.exe' with the '--headless' command-line argument spawns 'cmd.exe', which subsequently executes 'powershell.exe'. This pattern is often indicative of automated execution, lateral movement, or malicious script deployment using obfuscated or hidden command-line execution methods.
Detects files with names containing '-EMS' or the specific string 'PO26-EMS134.zip' being created or written to the 'Downloads' directory by common web browsers. This pattern is often associated with phishing campaigns distributing malicious attachments.
Detects execution of Monero mining indicators by a root-privileged process descended from screensharingd or its file-copy helpers, within 30 minutes of a Screen Sharing session on the host.
Detects a root-privileged Screen Sharing session with no successful authentication event in the preceding window, indicating exploitation of the screensharingd pre-auth bypass (CVE-2026-65400); excludes known ARD/MDM admin workflows.
Detects ad-hoc code-signing or quarantine-attribute removal on a binary delivered via the Screen Sharing file-copy channel or another network delivery within the preceding 30 minutes, indicating Gatekeeper-bypass preparation of a downloaded exploit tool.
Detects a process other than screensharingd bound to or handling network traffic on screensharingd's expected port (5900), indicating exploitation of the connection-interception logic flaw (CVE-2026-43779).
Detects a root-privileged child process spawned from screensharingd with no corresponding authorization/sudo prompt, indicating privilege escalation via the post-auth logic flaw CVE-2026-43760.
Detects the Screen Sharing file-copy helper (SSFileCopySender/SSFileCopyReceiver) running as UID 0/GID 80 while the connected session user is non-root/non-admin, indicating abuse of the arbitrary root file read/write primitive.
Detects bursts (3+ within 10 minutes) of screensharingd crash/respawn or anomalous child-process events consistent with the CVE-2026-43777 denial-of-service condition, excluding OS update/boot windows.
Detects a LaunchAgent plist written by screensharingd or its file-copy helpers, indicating persistence staged via the file-copy root-write primitive; excludes known legitimate installer paths.
Detects a root-privileged child process of screensharingd with no corresponding TCC daemon activity on the host, indicating a TCC-bypassing privilege escalation via the pre-auth vulnerability.
Detects the correlated sudoers-based privilege escalation chain: a non-root user writing a root-owned sudoers.d policy via the Screen Sharing file-copy channel, followed by passwordless sudo execution, followed by an outbound network connection as root within bounded time windows.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects correlated SMOKE#SCREEN activity where a victim host is served a fake Zoom/Flash update lure, an HTTP response containing a JavaScript auto-download trigger, and a Dropbox-hosted payload link, all within the same hourly window.
Detects cscript.exe/wscript.exe execution where the command line contains both low-RAM sandbox detection indicators and analysis-tool/process enumeration indicators, consistent with VBScript-based sandbox evasion logic observed in the SMOKE#SCREEN campaign.
Detects the SMOKE#SCREEN loader.cs technique of inserting a ~180 second delay between ScreenConnect/RMM MSI installation and the resulting service start, deliberately used to break EDR/SIEM correlation windows.
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Detects PowerShell or pwsh processes that download remote content and subsequently compile it in-memory using Add-Type, a fileless execution technique observed in the SMOKE#SCREEN campaign to load .NET loaders without writing an executable to disk.
Detects PowerShell (or pwsh) processes that both download a file to a temp-like location and subsequently execute or install it within a short time window on the same host, indicative of a staged loader/dropper download-and-execute pattern.
Page 1 of 2