Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
Platforms
1
1
Products / Services
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
Detects requests for a specific favicon image (`/img/ib99-hq.ico`) that is consistently used across all deployments of a threat actor's Next.js gambling kit. This kit is associated with the "Borrowed Trust" campaign. The rule identifies these requests in both endpoint network telemetry and perimeter proxy/firewall logs, indicating potential reconnaissance or active exploitation attempts targeting systems hosting this gambling kit.
Detects programs that connect to known malware callback ports based on threat intelligence reports. This rule specifically targets Linux systems and filters out connections to common local IP ranges to reduce false positives.
