Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
5
3
1
1
Contributors
5
3
1
1
Categories
5
5
4
2
1
Platforms
7
5
2
1
Products / Services
5
2
2
2
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects network communication associated with the Cyclops Blink modular malware, specifically targeting known Sandworm C2 IP addresses and non-standard ports used for firewall rule manipulation and C2 beaconing. The rule identifies both inbound and outbound traffic, including potential TLS handshakes on specific non-standard ports.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
Detects a non-browser process reading browser profiles, cookies, form stores, or session files from Chrome, Edge, Brave, or Opera browsers. The rule specifically looks for file events (creation, writing, deletion) on browser-related files like 'Cookies', 'Login Data', 'Web Data', 'History', or 'Local State' within browser user data directories, where the process performing the action has a filename matching common RAT patterns like 'banana', 'client', 'update', or 'service'.
This query searches for not onboarded devices with a specific Suffix
The following analytic detects command-line activities that redirect stdout or stderr to the /dev/null file. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This behavior is significant as it can indicate attempts to hide command outputs, a technique observed in the CyclopsBlink malware to conceal modifications to iptables firewall settings. If confirmed malicious, this activity could allow an attacker to stealthily alter system configurations, potentially leading to unauthorized access or persistent control over the compromised machine.
The analytic detects the execution of a kworker process with a command line in writable directories such as /home/, /var/log, and /tmp on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process paths. This activity is significant as kworker processes are typically kernel threads, and their presence in writable directories is unusual and indicative of potential malware, such as CyclopsBlink. If confirmed malicious, this could allow attackers to blend malicious processes with legitimate ones, leading to persistent access and further system compromise.
The analytic detects suspicious command-line activity that modifies the iptables firewall settings on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command patterns that alter firewall rules to accept traffic on certain TCP ports. This activity is significant as it can indicate malware, such as CyclopsBlink, modifying firewall settings to allow communication with a Command and Control (C2) server. If confirmed malicious, this could enable attackers to maintain persistent access and exfiltrate data, posing a severe security risk.