Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
53
6
3
2
1
Contributors
65
Categories
22
14
9
7
5
Platforms
39,936
7,266
6,537
3,866
3,647
65
Products / Services
24
9
8
8
5
MITRE Techniques
15
8
7
6
6
CVEs
4
3
2
2
IDS Classtypes
30
13
4
3
1
IDS Protocols
16
16
7
4
1
Detects an AI agent sandbox exfiltrating harvested PII/session context by embedding it as an x-auth-token query parameter in an outbound HTTP request to an external host — the network-observable exfiltration stage of Cryptographic Context Injection.
Detects an egress transfer of 100-120KB to known ACRStealer C2 IPs (45.155.68.45, 104.21.70.245) immediately followed within 60 seconds by an ingress transfer of 4-8MB, matching the campaign's post-collection exfiltration-then-payload-ingress pattern.
Detects the JWR phishing kit's WebSocket upgrade request to its hardcoded C2 path pattern combined with a JWRCVV-format session token, identifying the framework's persistent live-operator channel.
Detects outbound TCP traffic to known PurpleDelta-associated infrastructure IP addresses on common remote-access/web ports (80, 443, 3389), indicating potential communication with North Korean IT-worker facilitator infrastructure. Scope is limited to static IP indicators from Appendix A; does not cover Astrill VPN egress ranges or shell-company recruitment domains (minicursor[.]com), which would require separate signatures.
Detects JWR's real-time keystroke/card exfiltration by matching the hardcoded WebSocket C2 path token together with an instructionAck message containing instruction_id and cvv_id fields.
Detects HTTP requests to the JWR phishing framework's REST-based alternate C2 API surface, covering beaconing, exfiltration POSTs, CVV capture, instruction polling/acknowledgment, and device/IP fingerprint sync across five distinct endpoints.
Detects DNS resolution and subsequent TLS connection to the ACRStealer Telegram-based Dead Drop Resolver domain (res.explicittweak.cc), used to fetch C2 configuration via Telegram's IP range.
Detects the fake Adobe Flash update download from microsoft-flash[.]com/download/Adobeinstall.exe, served only after Jewelbug's 'flash' module validates the victim's targeted domain, account status, and OS.
Detects network access to known repositories hosting the publicly disclosed ShieldBreak Microsoft Defender zero-day bypass PoC/tooling (GitHub, Project Nightcrawler, Church of Malware mirrors) via HTTP host/URI or TLS SNI matching.
Detects DNS, HTTP, and TLS access to the public code-hosting repositories publishing the ShieldBreak Microsoft Defender 0-day exploit (GitHub, git.projectnightcrawler.dev, git.churchofmalware.org).
Detects JSON-RPC eth_call requests to the UNC5142 EtherHiding C2 configuration contract (0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1, selector 0x1dcf296b) from non-browser clients, indicating the DeviceManager RAT resolving its C2 address via Ethereum smart contract.
Detects network retrieval of the ShieldBreak exploit PoC or the UnDefend companion tool from their known distribution infrastructure (git.projectnightcrawler.dev, github.com/Nightmare-Eclipse/UnDefend) via TLS SNI or HTTP host/URI matching.
Detects XG-Web implant check-in beacons — DNS lookups and HTTP config_*.js fetches — against Jewelbug's typosquatted C2 domain set, the unified panel reported to have logged over one million implant check-ins.
Detects a DNS query with a high-entropy label repeated identically as both subdomain and domain (e.g. X.X), used by ACRStealer as a connectivity/canary check prior to establishing C2.
Detects encapsulated C2 traffic over non-standard ports and DNS/HTTP tunneling patterns using entropy/volume thresholds and sustained-pattern requirements to avoid matching ordinary long DNS queries, excluding known legitimate tunneling tools/VPN endpoints.
Detects use of default SSL-VPN administrator credentials from external or unusual source geographies after production provisioning, where account-lockout controls are absent — the initial-access vector observed in Gunra intrusions.
Detects DNS queries and HTTP traffic to Jewelbug's known typosquatted C2 domains (fonts.chrorne[.]com, fonts.tarotfree101[.]top, robot.avbliud[.]com, www.f1ash[.]org[.]cn) via exact-match logic to avoid fuzzy-matching false positives.
Detects a ClientKing-style beacon abusing internal proxy CONNECT authentication to reach known Jewelbug C2 infrastructure (tarotfree101.top), reusing a compromised organization's own proxy the way Jewelbug reused a major aerospace manufacturer's internal proxy.
Detects Antino's abuse of trusted cloud services — Microsoft Graph API and Google Docs — as C2 channels, gated on non-standard TLS ports, missing browser User-Agent, and non-HTML response bodies to reduce false positives from the very high volume of legitimate traffic to these domains.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects DNS, TLS SNI, and HTTP Host traffic to the known ClickFix delivery domain karburatorotzhigi[.]com or the exact Cloudflare R2 hosting bucket subdomain pub-b7e3d7ad9f6e4b08a24cde45feeb417e.r2[.]dev used in UNC5142 campaign infrastructure.
Page 1 of 4