Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
8
1
1
1
Contributors
11
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
9
1
1
1
1
Products / Services
4
4
2
1
1
MITRE Techniques
3
2
1
1
1
CVEs
1
IDS Classtypes
6
1
1
IDS Protocols
4
2
2
Detects TLS sessions to Sapphire Sleet/UNC1069 Hostwinds C2 infrastructure presenting the exact self-signed certificate issuer string linked to the Mastra/axios campaigns.
Detects spearphishing email impersonating the CSIS 'Indo-Pacific Forecast 2026' invitation-only event lure, gated on CSIS branding/display name combined with a sender domain that does not match csis.org.
Detects the fake Adobe Flash update download from microsoft-flash[.]com/download/Adobeinstall.exe, served only after Jewelbug's 'flash' module validates the victim's targeted domain, account status, and OS.
Detects DNS, HTTP, and TLS access to the public code-hosting repositories publishing the ShieldBreak Microsoft Defender 0-day exploit (GitHub, git.projectnightcrawler.dev, git.churchofmalware.org).
Detects DNS queries and HTTP traffic to Jewelbug's known typosquatted C2 domains (fonts.chrorne[.]com, fonts.tarotfree101[.]top, robot.avbliud[.]com, www.f1ash[.]org[.]cn) via exact-match logic to avoid fuzzy-matching false positives.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects TLS SNI and HTTP Host values matching Jewelbug's typosquatted-domain pattern impersonating the OKX and Binance cryptocurrency exchanges, used to drive traffic to cloaked phishing pages.
Detects obfuscated JavaScript payload generated via the XG-Web code-generation platform and hosted on typosquatted fonts.tarotfree101.top domain, used by Jewelbug
Detects DNS queries for Storm-2945 Microsoft-impersonating doppelganger domains and traffic to actor-controlled AitM resolver/redirect infrastructure on captive-portal networks.
Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.
Detects the Hermes Agent/DeepSeek autonomous CVE-research pivot pattern — proxy traffic showing both a GitHub trending-PoC search sorted by stars and a CVSS/exploitability scoring pipeline query, indicating autonomous vulnerability research and target re-selection after a failed exploitation attempt.