Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Detects ClientKing's custom DNS-tunneling C2 channel via high-entropy, long subdomains in TXT-record queries at sustained volume.
Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.
Detects sustained high-volume automated HTTP request patterns from internal hosts to known new-api/one-api transfer station proxy domains (amutes.com, abb1.life) used to resell stolen AI API access, requiring volume above a dynamic baseline over a 10-minute window and excluding approved internal API gateways or vetted integration partners.
Detects outbound network traffic from internal hosts to domains and IP addresses identified as part of the LinX Coders infrastructure used for Mirage2FA adversary-in-the-middle (AiTM) phishing and credential harvesting campaigns.
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
ChainDrop Shai-Hulud npm Worm C2 beacon POST /router Bun/1.3.13 UA to npm-cache.com
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
Reverse Tunnel Traffic to localhost.run lhr.life Subdomain
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
ChainDrop Shai-Hulud 2.0 EtherHiding C2 Domain Lookup via eth_call
Detects DNS TXT queries for the _beacon fallback command-and-control subdomain under mangorbit.com, associated with the Open VSX evil twin extension campaign.
Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.
ChainDrop Shai-Hulud npm Worm C2 beacon POST /router Bun/1.3.13 UA to npm-cache.com
Detects direct, unproxied outbound TLS traffic from a scoped server/DMZ network segment to the DeepSeek or Aliyun DashScope LLM APIs at a repeated rate, indicative of Hermes Agent autonomous attack orchestration.
Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.
Outbound HTTP exfiltration to mangorbit.com C2 subdomains
Detects DeviceManager DNS TXT/A tunneling traffic occurring within 60 seconds after an eth_call blockchain RPC request from the same host, consistent with DeviceManager resolving C2 via EtherHiding before tunneling.
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Page 18 of 24