Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
Contributors
7
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
3
3
1
Products / Services
3
3
3
1
1
MITRE Techniques
4
3
3
1
1
CVEs
3
3
IDS Classtypes
1
1
IDS Protocols
1
1
1
Detects JSON-RPC eth_call requests to the UNC5142 EtherHiding C2 configuration contract (0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1, selector 0x1dcf296b) from non-browser clients, indicating the DeviceManager RAT resolving its C2 address via Ethereum smart contract.
Detects DNS, TLS SNI, and HTTP Host traffic to the known ClickFix delivery domain karburatorotzhigi[.]com or the exact Cloudflare R2 hosting bucket subdomain pub-b7e3d7ad9f6e4b08a24cde45feeb417e.r2[.]dev used in UNC5142 campaign infrastructure.
Detects the DeviceManager RAT (run.pyw, spawned via python.exe/pythonw.exe) launching PowerShell or cmd with encoded/obfuscated arguments (-enc, -EncodedCommand, -e, -nop, -w hidden), consistent with C2-tasked arbitrary command execution.
Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.