Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
10
9
1
Contributors
20
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
13
7
Products / Services
8
5
3
2
2
MITRE Techniques
6
4
3
3
2
CVEs
2
IDS Classtypes
7
1
1
1
IDS Protocols
3
2
Correlation detection for the PureLogs Stealer / fake Adobe Sign campaign. Fires when 3+ of 6 distinct attacker behaviors (Downloads-sourced 'output_*.js' execution via wscript/cscript, UserinitMprLogonScript persistence pointing at a .js payload, PowerShell fileless env-var payload reconstruction via [System.Environment]::GetEnvironmentVariable+IEX, in-memory .NET Assembly.Load without a disk-based .dll/.exe argument, PowerShell-initiated PixelDrain PNG retrieval, and PowerShell-initiated C2 traffic to vm180012.hosted-by.qwins.co) occur on the same host within a 15-minute window. All network/PowerShell legs are scoped to powershell.exe specifically to avoid flagging benign browser traffic to the legitimate PixelDrain file-sharing service.
Detects network requests targeting 'chickplaybox.com', which is associated with a phishing campaign masquerading as the Adobe Sign platform. This rule monitors both cleartext HTTP host headers and TLS SNI fields to identify attempts to access the malicious domain.
Detects network activity (DNS queries and TLS connections) to the known command-and-control (C2) domain 'vm180012.hosted-by.qwins.co' associated with the PureLogs Stealer malware.
Detects network activity associated with the PureLogs Stealer, specifically connections to identified infrastructure hosting payloads on Pixeldrain and attempts to retrieve steganographic payloads via specific API endpoints.
Detects DNS/HTTP beaconing to known OnyxC2 domains or suspicious top-level domains (.top, .cyou, .lol, .online) initiated by a non-browser or newly-created process, plus correlated network-IDS alerts.
Detects HTTP requests to the OnyxC2 backend API sync endpoint (akmuniverstall.top) carrying the characteristic hwid, ownertoken, and botversion=3.0 parameters used for device-fingerprint C2 check-ins.
Detects creation of a non-default hidden desktop by a browser process, correlated with either an inherited long-lived authenticated browser network session or a non-standard parent process, consistent with OnyxC2's HVNC capability.
Detects sustained HTTP reverse-shell beaconing, SOCKS5 proxy handshake patterns, or TOR-like traffic on TOR guard/entry ports, originating from a non-browser process, consistent with OnyxC2's multi-channel remote-access toolkit.
Detects HTTP requests to known Storm-2755 Payroll Pirates AiTM lookalike proxy domains that also reference Microsoft authentication infrastructure in the URI, indicating a reverse-proxy phishing kit relaying to real Microsoft login endpoints.
Correlates network connections to known OnyxC2 C2/delivery domains and Cloudflare-fronted IPs with the malware's sideloaded-process indicators to detect delivery and command-and-control traffic.
Detects contact with the OnyxC2 lure landing page performing canvas fingerprinting (multiboardthe.com) correlated with a subsequent registry write from the known dropper process, tying victim-vetting to the OnyxC2 install chain.
Detects DNS queries to Google Ads click-tracking infrastructure followed within 60 seconds by resolution of a newly registered, previously unseen domain, consistent with the Storm-2755 AiTM redirect chain.
Detects POST requests to the Storm-2755 Payroll Pirates AiTM toolkit fingerprinting endpoint URI pattern co-occurring with the distinctive openresty/PHP response header combination.
Matches endpoint file/process hashes and network IPs against a curated, freshness-checked OnyxC2 indicator feed.
Detects a multi-hop HTTP redirect chain traversing two or more known OnyxC2 phishing lure domains from the same host within a two-minute window, consistent with the redirect obfuscation used before final payload delivery.
Detects AiTM phishing page geolocation fingerprint script referencing api.country.is, setting an rcfh_country cookie, and redirecting via oauth2/v2.0/authorize.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
Detects an encrypted/unsigned file download immediately following execution of a known OnyxC2 install-lure process (Setup_File*/Fling-Standalone* or a known lure hash), consistent with the AES-256-encrypted build/payload retrieval used to evade network content inspection.
Detects likely exfiltration of encrypted synced passkey (WebauthnCredentialSpecifics) blobs to external C2 infrastructure, correlated with a prior non-browser read of Chrome's Sync Data LevelDB store, consistent with the collection-and-exfiltration stage of a Pass-ta-key credential-theft chain. Excludes traffic destined to Google's own domains.
Detects a network connection to Google's passkey enclave or caBLE hybrid-transport domain (*.ua5v.com) that should be correlated with EDR process telemetry to confirm the source process is non-browser, unsigned, or otherwise anomalous rather than the legitimate Chrome browser.