Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
36
26
15
11
9
Contributors
97
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
44
38
22
9
6
Products / Services
19
12
10
8
7
MITRE Techniques
35
21
20
16
12
IDS Classtypes
18
15
2
1
IDS Protocols
13
11
5
4
1
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects python.exe binding a loopback listener on port 8000, 8001, or 8002 and then spawning cmd.exe or powershell.exe within 5 minutes of the listener being established, consistent with SNOWBASIN Python bindshell behavior observed in the UNC6692 Edgecution campaign.
Detects DNS queries for Storm-2945 Microsoft-impersonating doppelganger domains and traffic to actor-controlled AitM resolver/redirect infrastructure on captive-portal networks.
Reverse Tunnel Traffic to localhost.run lhr.life Subdomain
Detects mshta.exe invoked with a remote HTTP(S) URL argument, consistent with CountLoader's taskType 10 command proxying malicious script execution through mshta.exe, excluding local file/HTA paths.
Detects a high-volume DNS TXT-record query flood (200+ queries in 5 minutes) to a single destination, excluding common legitimate high-volume TXT consumers (SPF/DKIM/DMARC validators), indicative of DNS tunneling.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects execution/creation of the fake Zoom update installer (ZoomUpdateInstaller.pkg) on macOS endpoints correlated with a network connection to the SMOKE#SCREEN campaign relay IP 207.174.0.143 on port 8080.
Detects known CornFlake and ChocoShell malware binaries by exact full SHA-256 hash of executable files (file-write/process-creation scope), not incidental hash string mentions
Detects payload callbacks to the Rognar Telegram-bot-linked DOUBLECUP C2 URL (hxxp://67.219.107.181/hgflssvslvidfugvbldiuv).
Detects presence of pritunl-client or wireguard-go binary/name strings, tunnel/VPN-class tooling observed landing on host prior to agent-parented tunnel activity
Detects a companion payload masquerading as svchost32.exe that exposes a localhost HTTP API with /upload, /reload, or /status endpoints, consistent with CornFlake's modular C2 tasking behavior.
Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.
Detects scripts combining a certutil -decode (or equivalent decode) command, a reference to the cached stego-image.png, and the ZZ1984 embedded marker string used by DOUBLECUP to extract steganographic payloads from PNG images via LSB extraction
Detects rundll32.exe executing a DLL that was written to a user-profile/AppData path within the preceding 15 minutes, consistent with CountLoader's taskType 3 command dispatch downloading and invoking an attacker-specified exported function.
Detects HTTP GET requests for sync.dat runtime configuration files with a JSON accept header, consistent with CornFlake RAT's custom C2 protocol, excluding known legitimate cloud-sync/update CDN hosts.
Detects successful DNS resolution responses, TLS SNI values, and HTTP Host headers referencing known Shai-Hulud/Miasma token-jacking transfer station infrastructure (amutes.com, abb1.life) used by attackers to resell stolen AI/LLM API access via gray-market proxy services.
Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Page 4 of 5