Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
8
2
1
1
Contributors
12
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
8
5
1
Products / Services
3
2
1
1
1
MITRE Techniques
4
3
2
2
2
CVEs
1
IDS Classtypes
4
3
IDS Protocols
2
2
1
Detects an AI agent sandbox exfiltrating harvested PII/session context by embedding it as an x-auth-token query parameter in an outbound HTTP request to an external host — the network-observable exfiltration stage of Cryptographic Context Injection.
Detects the C2Looper secondary payload dropped as pld.exe under %LocalAppData%, typically staged as a ransomware precursor after backdoor check-in.
Detects C2Looper v1 HTTP beaconing and result reporting to hardcoded C2 IP addresses over port 8888 via the /api/beacon and /api/result endpoints.
Detects the C2Looper secondary payload dropped as pld.exe under %LocalAppData%, typically staged as a ransomware precursor after backdoor check-in.
Detects network retrieval of the ShieldBreak exploit PoC or the UnDefend companion tool from their known distribution infrastructure (git.projectnightcrawler.dev, github.com/Nightmare-Eclipse/UnDefend) via TLS SNI or HTTP host/URI matching.
Detects C2Looper v2 retrieving GitHub-hosted C2 tasking files (cmd.json, result.json, beacon.json) via raw.githubusercontent.com or api.github.com, requiring repeated requests to reduce false positives from incidental single fetches.
Detects driver-level WFP filter/callout registration at network-redirection-relevant layers that can be used to redirect or interfere with security-vendor network traffic (G12 capability).
Detects possible kernel-level WFP redirection of outbound HTTP connections to an unexpected local loopback proxy port while the original destination host header is retained, consistent with Phantom Mantis G12/G13 network redirection.
Detects PyArmour-obfuscated PyInstaller backdoor binaries associated with STAC4749 that stage base_library.zip and communicate with workers.dev C2 infrastructure
STAC4749 Golang Implant TLS Certificate with Hardcoded CA Issuer (loop-CA/connectify-CA/james-bond-CA)
STAC4749 sc5.exe reverse SOCKS proxy C2 domain query (legio.name)
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain