Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
15
9
Contributors
23
1
Categories
20,597
11,939
5,911
5,195
4,872
Platforms
14
6
3
2
1
Products / Services
5
5
4
3
2
MITRE Techniques
6
4
2
2
2
CVEs
2
1
1
1
IDS Classtypes
8
3
2
1
1
IDS Protocols
5
4
2
2
1
Detects legacy RFB security-type 2 (VNC password) authentication negotiation against macOS Screen Sharing from external sources, indicating legacy-VNC administration or abuse of the CVE-2026-43760 legacy-auth path that retains root file-copy authority.
Detects the CVE-2026-65400 pre-auth bypass exploitation of macOS Screen Sharing via an oversized RFB SRP (security-type 36) authentication frame length field, correlated with the connection subsequently reaching an authenticated state.
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Detects an egress transfer of 100-120KB to known ACRStealer C2 IPs (45.155.68.45, 104.21.70.245) immediately followed within 60 seconds by an ingress transfer of 4-8MB, matching the campaign's post-collection exfiltration-then-payload-ingress pattern.
Detects completed RFB/VNC protocol handshakes to internal macOS Screen Sharing hosts (TCP/5900) from external networks, thresholded to separate reconnaissance/scanning from single stray connections. Early-warning exposure signal for CVE-2026-65400 targeting.
Detects the JWR phishing kit's WebSocket upgrade request to its hardcoded C2 path pattern combined with a JWRCVV-format session token, identifying the framework's persistent live-operator channel.
Detects outbound TCP traffic to known PurpleDelta-associated infrastructure IP addresses on common remote-access/web ports (80, 443, 3389), indicating potential communication with North Korean IT-worker facilitator infrastructure. Scope is limited to static IP indicators from Appendix A; does not cover Astrill VPN egress ranges or shell-company recruitment domains (minicursor[.]com), which would require separate signatures.
Detects DNS resolution and subsequent TLS connection to the ACRStealer Telegram-based Dead Drop Resolver domain (res.explicittweak.cc), used to fetch C2 configuration via Telegram's IP range.
Detects OpenSSH installation on Windows hosts, unexpected internal SSH sessions, and SSH tunnels terminating at an external (non-RFC1918) destination — particularly from SSL-VPN admin hosts — excluding documented DevOps CI/CD runners and known bastion hosts.
Correlates DNS/network requests to newly observed domains matching JWR's brand-plus-suffix generation pattern across .top/.cfd/.info/.cc TLDs, requiring multiple distinct hostnames sharing the same brand token within a short window to flag likely batch-registered phishing infrastructure.
Detects execution of RClone from non-standard directories or outbound transfer to cloud endpoints outside an approved destination list, consistent with Gunra's pre-encryption data-exfiltration tooling.
Detects Impacket-style (wmiexec, secretsdump, atexec, psexec.py, smbclient.py) and PsExec SMB admin-share lateral movement, excluding approved IT admin accounts and management servers.
Detects a DNS query with a high-entropy label repeated identically as both subdomain and domain (e.g. X.X), used by ACRStealer as a connectivity/canary check prior to establishing C2.
Detects encapsulated C2 traffic over non-standard ports and DNS/HTTP tunneling patterns using entropy/volume thresholds and sustained-pattern requirements to avoid matching ordinary long DNS queries, excluding known legitimate tunneling tools/VPN endpoints.
Detects use of default SSL-VPN administrator credentials from external or unusual source geographies after production provisioning, where account-lockout controls are absent — the initial-access vector observed in Gunra intrusions.
Detects large-volume outbound TLS transfers scoped to mega.nz/mega.io SNI/destination, tuned against a typical daily-use baseline so routine small file-sharing does not trigger, consistent with Gunra's confirmed exfiltration of up to tens of terabytes to Mega.
Detects certutil.exe -urlcache usage or PowerShell Invoke-WebRequest retrieving main.exe/cryptor.exe or similarly named payloads, followed by execution of the downloaded file, excluding downloads from an allowlist of approved internal software-distribution domains.
Network signature for the specific WebSocket/admin-API request sequence used to exploit the FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472, as leveraged by Gunra ransomware affiliates for initial access.
Network detection for Sliver C2 framework beaconing, tightened to require JA3/JA3S fingerprints and certificate-field patterns characteristic of Sliver's default TLS templates rather than generic self-signed certificates.
Detects FileZilla FTP client traffic patterns and large single-session outbound FTP transfers to external hosts above a tuned threshold, weighted more heavily outside business hours, excluding known internal FTP servers/vendors and approved data-transfer partners.
Network signature matching known Gunra C2 IP addresses, the datapub.news leak/paste domain, and Gunra-associated .onion leak/negotiation sites.
Page 1 of 2