Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
2
2
1
Categories
3
3
3
2
2
Platforms
5
Products / Services
4
3
1
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
4
IDS Protocols
3
1
Detects network traffic (TLS SNI and HTTP Host headers) attempting to connect to known command-and-control infrastructure associated with the NodeRabbit RAT and Mirage Kitten campaign. The rule monitors for unauthorized connectivity to specific domains including 'oracle-challenge.s3.us-east-1.amazonaws.com', 'plugplay.azurewebsites.net', and 'lifespotify.com'.
This rule detects a multi-stage phishing redirection chain where a user visits a known survey platform (t.maze.co) followed immediately by a request to a Cloudflare Workers landing page (.workers.dev), a common pattern used by adversaries to obfuscate malicious delivery endpoints.
Detects DNS queries for domains resolving to specific Cloudflare nameserver pairs associated with the Exvicy malware distribution framework. The rule monitors for NS records pointing to 'randy.ns.cloudflare.com' and 'stevie.ns.cloudflare.com', optionally filtering by domains containing keywords commonly used in Exvicy-themed phishing or C2 infrastructure.
Detects network indicators associated with the Exvicy ClickFix campaign, including HTTP callbacks to embed endpoints, DNS queries for the 'cloudflare-check.net' domain, direct connections to the identified C2 IP address (94.26.90.126), and HTTP responses containing fake 'Security Check' iframe content.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
