Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
19
9
5
2
1
Contributors
36
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
19
11
2
2
2
Products / Services
15
8
5
2
2
MITRE Techniques
27
14
8
6
4
CVEs
2
1
1
IDS Classtypes
3
2
IDS Protocols
4
1
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
Detects Abyssos RAT KEYLOGGER module by requiring SetWindowsHookEx-style capture strings to co-occur with the klog-prefixed drop artifact or windows_update_cache.json log file, reducing false positives from generic hook installers; also flags XOR key, export function abyss, and KEYLOGGER_GETLOGS command
Correlates Abyssos file-collection/archival commands (GRABBER_START/FM_GET/FM_ARCHIVE/FM_ADDTOARCHIVE) — requiring at least 5 collected files before an archive — with a subsequent non-standard-port outbound connection within 30 minutes, consistent with staged exfiltration over the AES-GCM C2 channel.
Detects a masquerading svchost32.exe process exhibiting two or more correlated surveillance capabilities (webcam, microphone, screenshot/JPEG, WAV audio, removable media access), consistent with CornFlake RAT surveillance.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects a process running from a path ending in svchost32.exe performing an unusually high volume of file open/read/rename/write operations or transferring a large total byte volume within a 1-hour window, consistent with CornFlake bulk file collection/exfiltration nearing its documented throttle limits.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects a rapid sequence of blind boolean SQL injection probes against the author_exclude parameter using ASCII/SUBSTRING syntax and the X-WP-Total header oracle (CVE-2026-60137).
Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.
Page 2 of 2