Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
53
6
3
2
1
Contributors
65
Categories
22
14
9
7
5
Platforms
39,936
7,266
6,537
3,866
3,647
65
Products / Services
24
9
8
8
5
MITRE Techniques
15
8
7
6
6
CVEs
4
3
2
2
IDS Classtypes
30
13
4
3
1
IDS Protocols
16
16
7
4
1
Detects creation of the malicious persistent 'forticloud-sync' super-user account on FortiOS following an anomalous admin WebSocket session, consistent with post-exploitation of CVE-2024-55591/CVE-2025-24472.
Detects HTTP requests to known Storm-2755 Payroll Pirates AiTM lookalike proxy domains that also reference Microsoft authentication infrastructure in the URI, indicating a reverse-proxy phishing kit relaying to real Microsoft login endpoints.
Detects large-volume outbound TLS transfers scoped to mega.nz/mega.io SNI/destination, tuned against a typical daily-use baseline so routine small file-sharing does not trigger, consistent with Gunra's confirmed exfiltration of up to tens of terabytes to Mega.
Detects TLS SNI and HTTP Host values matching Jewelbug's typosquatted-domain pattern impersonating the OKX and Binance cryptocurrency exchanges, used to drive traffic to cloaked phishing pages.
Detects ClientKing's custom DNS-tunneling C2 channel via high-entropy, long subdomains in TXT-record queries at sustained volume.
Detects ELF binaries embedding the ClientKing implant name alongside structural indicators (Rust runtime markers or C2 configuration patterns), associated with Jewelbug espionage tooling targeting Linux servers and routers
Detects accounts authenticating from compromised webmail/CMS infrastructure that pivot, within a tight time window and matching source IP, to authenticate against internal virtualization-management systems — the lateral-movement pattern Jewelbug used to reach a national webmail estate's backing infrastructure.
Network signature for the specific WebSocket/admin-API request sequence used to exploit the FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472, as leveraged by Gunra ransomware affiliates for initial access.
Detects Abyssos RAT C2 traffic via its literal HELLO|...|v2.4F registration banner combined with an AES-GCM-sized payload to two known hardcoded C2 IPs.
Network detection for Sliver C2 framework beaconing, tightened to require JA3/JA3S fingerprints and certificate-field patterns characteristic of Sliver's default TLS templates rather than generic self-signed certificates.
Detects DNS queries to Google Ads click-tracking infrastructure followed within 60 seconds by resolution of a newly registered, previously unseen domain, consistent with the Storm-2755 AiTM redirect chain.
Detects POST requests to the Storm-2755 Payroll Pirates AiTM toolkit fingerprinting endpoint URI pattern co-occurring with the distinctive openresty/PHP response header combination.
Detects sustained high-volume automated HTTP request patterns from internal hosts to known new-api/one-api transfer station proxy domains (amutes.com, abb1.life) used to resell stolen AI API access, requiring volume above a dynamic baseline over a 10-minute window and excluding approved internal API gateways or vetted integration partners.
Detects FileZilla FTP client traffic patterns and large single-session outbound FTP transfers to external hosts above a tuned threshold, weighted more heavily outside business hours, excluding known internal FTP servers/vendors and approved data-transfer partners.
Network signature matching known Gunra C2 IP addresses, the datapub.news leak/paste domain, and Gunra-associated .onion leak/negotiation sites.
Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.
Detects AiTM phishing page geolocation fingerprint script referencing api.country.is, setting an rcfh_country cookie, and redirecting via oauth2/v2.0/authorize.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
Detects obfuscated JavaScript payload generated via the XG-Web code-generation platform and hosted on typosquatted fonts.tarotfree101.top domain, used by Jewelbug
Detects SSL-VPN traffic-control/promiscuous-mode changes triggered by unexpected or unsigned processes outside approved maintenance windows, consistent with Gunra's interception of VDI authentication traffic.
Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.
Page 2 of 4