Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detects Koktevrat Android RAT APK artifacts via obfuscated component class names (JyfNnJyj, GtVyayDo) and the Stage 2 package identifier com.kowo.ciligeci
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Detects rapid ICMP (ping) traffic directed towards specific internal and external hosts, characteristic of the RedTail Linux malware attempting to perform network discovery or validate connectivity to command-and-control infrastructure.
Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.
This rule monitors for network connections to known command-and-control (C2) IP addresses and the execution or presence of files matching known hashes associated with the 'PhantomC2' threat group or malware family. It correlates data from DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to identify potential compromise.
Matches known Phantom Stealer MaaS infostealer sample hashes
Matches known SilverFox malware payload samples by SHA256 hash
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects network traffic associated with SloppyRAT C2 beacons by identifying specific user-agent strings ('CommandExecutor/1.0', 'Mozilla/5.0 (compatible; DLLMemLoader/1.0)') or anomalous API path requests containing 'X-API-Key' or 'Authorization: Bearer' headers.
Page 51 of 232