Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
36
26
15
11
9
Contributors
97
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
44
38
22
9
6
Products / Services
19
12
10
8
7
MITRE Techniques
35
21
20
16
12
IDS Classtypes
18
15
2
1
IDS Protocols
13
11
5
4
1
Detects DeviceManager DNS TXT/A tunneling traffic occurring within 60 seconds after an eth_call blockchain RPC request from the same host, consistent with DeviceManager resolving C2 via EtherHiding before tunneling.
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
Detects CountLoader's C2 beacon sequence: an HTTP GET to /connect carrying XOR-hex-encoded host telemetry and a Bearer token, followed within an hour by a JWT-authenticated getUpdates POST from the same host/destination pair.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects short-lived execution of the compiled AppleScript loader from /tmp/p.app, correlated with its rapid creation-then-deletion pattern, the observable proxy for XCSSET's dual-key-encrypted loader architecture.
Detects an HTTP POST to an IP-literal host occurring after an eth_call blockchain RPC lookup from the same host, consistent with DeviceManager/DOUBLECUP resolving and beaconing to a C2 address extracted from blockchain-sourced configuration.
Detects DOUBLECUP's session polling/telemetry beacon to /session/reg, /session/check, and /session/signal with a sid= query parameter, requiring at least 5 requests within 15 seconds to match the malware's 1.2-3 second polling cadence.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects short-lived execution of the compiled AppleScript loader from /tmp/p.app, correlated with its rapid creation-then-deletion pattern, the observable proxy for XCSSET's dual-key-encrypted loader architecture.
Page 5 of 5