Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
36
26
15
11
9
Contributors
97
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
44
38
22
9
6
Products / Services
19
12
10
8
7
MITRE Techniques
35
21
20
16
12
IDS Classtypes
18
15
2
1
IDS Protocols
13
11
5
4
1
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects ClientKing's custom DNS-tunneling C2 channel via high-entropy, long subdomains in TXT-record queries at sustained volume.
Detects a 32-byte ICMP echo request carrying the backdoor's 8-byte bot ID, explicitly excluding the standard Windows ping.exe payload pattern (the dominant legitimate traffic at this size) and rate-limited to reduce alert volume.
Detects Abyssos RAT C2 traffic via its literal HELLO|...|v2.4F registration banner combined with an AES-GCM-sized payload to two known hardcoded C2 IPs.
Detects execution of a generically-named a.out binary from a non-standard path (/tmp or Downloads) or any command line referencing ngrok, indicating an ngrok reverse-tunnel binary disguised under a default compiler output name.
Detects execution of a generically-named a.out binary from a non-standard path (/tmp or Downloads) or any command line referencing ngrok, indicating an ngrok reverse-tunnel binary disguised under a default compiler output name.
Correlates DNS TXT-tunneling activity and HTTP POST traffic from the same host resolving to the same base destination domain within a 2-minute window, with minimum volume thresholds on each channel, consistent with malware that branches between DNS tunneling and HTTP POST C2 modes based on the first byte of a decrypted configuration string.
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects fake Adobe Flash/Adobe installer executables used by Jewelbug to drop the Antino backdoor, sideload slc.dll, install the 'PDF Viewer' extension, and register the com.microsoft.runedge native-messaging helper. Requires known filenames combined with known hashes or slc.dll/indicator strings, and excludes files carrying a valid Adobe code-signing certificate.
Detects sustained high-volume automated HTTP request patterns from internal hosts to known new-api/one-api transfer station proxy domains (amutes.com, abb1.life) used to resell stolen AI API access, requiring volume above a dynamic baseline over a 10-minute window and excluding approved internal API gateways or vetted integration partners.
Detects a cmd.exe process spawned as a direct child of a process that just established an outbound connection to a public IP, excluding common RMM/remote-support tools — consistent with Abyssos's C2CMD interactive reverse-shell capability.
Detects StopAndProtect campaign base64-encoded payload files staged in WordPress upload directories, requiring multiple named .b64 filenames or a base64 blob in a wp-content/uploads path context
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects python.exe/pythonw.exe executing compiled bytecode (.pyc/.pyz) from a non-standard installation path (excluding venv/site-packages/Program Files) with an outbound connection to a non-standard port within 5 minutes, consistent with DeviceManager RAT execution.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects the malicious signed 64-bit ARM Mach-O ngrok binary distributed as a.out, flagged by multiple AV engines as adware/hacktool ngrok
Detects cloudflared launched with 'tunnel --url' against localhost or api.trycloudflare.com without managed-tunnel authentication flags, indicating deployment of an ad-hoc Cloudflare Quick Tunnel exposing a local service to the internet.
Detects the Abyssos RAT main executable via known sample hashes, or by requiring a minimum weight/threshold of co-occurring structural PE traits (obfuscated single-executable-section layout, minimal static import table consistent with CRC32-based dynamic API hashing, and absence of a valid certificate), rather than any single trait alone.
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Page 3 of 5