Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
27
Contributors
27
Categories
12
5
4
3
3
Platforms
24
3
1
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
11
4
4
3
3
IDS Classtypes
16
10
IDS Protocols
10
7
5
3
1
Detects network requests targeting 'chickplaybox.com', which is associated with a phishing campaign masquerading as the Adobe Sign platform. This rule monitors both cleartext HTTP host headers and TLS SNI fields to identify attempts to access the malicious domain.
Detects network activity (DNS queries and TLS connections) to the known command-and-control (C2) domain 'vm180012.hosted-by.qwins.co' associated with the PureLogs Stealer malware.
Detects an egress transfer of 100-120KB to known ACRStealer C2 IPs (45.155.68.45, 104.21.70.245) immediately followed within 60 seconds by an ingress transfer of 4-8MB, matching the campaign's post-collection exfiltration-then-payload-ingress pattern.
Detects network activity associated with the PureLogs Stealer, specifically connections to identified infrastructure hosting payloads on Pixeldrain and attempts to retrieve steganographic payloads via specific API endpoints.
Detects the JWR phishing kit's WebSocket upgrade request to its hardcoded C2 path pattern combined with a JWRCVV-format session token, identifying the framework's persistent live-operator channel.
Detects JWR's real-time keystroke/card exfiltration by matching the hardcoded WebSocket C2 path token together with an instructionAck message containing instruction_id and cvv_id fields.
Detects HTTP requests to the JWR phishing framework's REST-based alternate C2 API surface, covering beaconing, exfiltration POSTs, CVV capture, instruction polling/acknowledgment, and device/IP fingerprint sync across five distinct endpoints.
Detects DNS resolution and subsequent TLS connection to the ACRStealer Telegram-based Dead Drop Resolver domain (res.explicittweak.cc), used to fetch C2 configuration via Telegram's IP range.
Detects the fake Adobe Flash update download from microsoft-flash[.]com/download/Adobeinstall.exe, served only after Jewelbug's 'flash' module validates the victim's targeted domain, account status, and OS.
Detects JSON-RPC eth_call requests to the UNC5142 EtherHiding C2 configuration contract (0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1, selector 0x1dcf296b) from non-browser clients, indicating the DeviceManager RAT resolving its C2 address via Ethereum smart contract.
Detects XG-Web implant check-in beacons — DNS lookups and HTTP config_*.js fetches — against Jewelbug's typosquatted C2 domain set, the unified panel reported to have logged over one million implant check-ins.
Detects a DNS query with a high-entropy label repeated identically as both subdomain and domain (e.g. X.X), used by ACRStealer as a connectivity/canary check prior to establishing C2.
Detects DNS queries and HTTP traffic to Jewelbug's known typosquatted C2 domains (fonts.chrorne[.]com, fonts.tarotfree101[.]top, robot.avbliud[.]com, www.f1ash[.]org[.]cn) via exact-match logic to avoid fuzzy-matching false positives.
Detects a ClientKing-style beacon abusing internal proxy CONNECT authentication to reach known Jewelbug C2 infrastructure (tarotfree101.top), reusing a compromised organization's own proxy the way Jewelbug reused a major aerospace manufacturer's internal proxy.
Detects Antino's abuse of trusted cloud services — Microsoft Graph API and Google Docs — as C2 channels, gated on non-standard TLS ports, missing browser User-Agent, and non-HTML response bodies to reduce false positives from the very high volume of legitimate traffic to these domains.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects DNS, TLS SNI, and HTTP Host traffic to the known ClickFix delivery domain karburatorotzhigi[.]com or the exact Cloudflare R2 hosting bucket subdomain pub-b7e3d7ad9f6e4b08a24cde45feeb417e.r2[.]dev used in UNC5142 campaign infrastructure.
Detects TLS SNI and HTTP Host values matching Jewelbug's typosquatted-domain pattern impersonating the OKX and Binance cryptocurrency exchanges, used to drive traffic to cloaked phishing pages.
Detects ClientKing's custom DNS-tunneling C2 channel via high-entropy, long subdomains in TXT-record queries at sustained volume.
Detects Abyssos RAT C2 traffic via its literal HELLO|...|v2.4F registration banner combined with an AES-GCM-sized payload to two known hardcoded C2 IPs.
Detects sustained high-volume automated HTTP request patterns from internal hosts to known new-api/one-api transfer station proxy domains (amutes.com, abb1.life) used to resell stolen AI API access, requiring volume above a dynamic baseline over a 10-minute window and excluding approved internal API gateways or vetted integration partners.
Page 1 of 2