Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
12
6
3
2
Contributors
23
Categories
15
10
6
5
5
Platforms
13
6
4
2
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
11
8
6
4
4
CVEs
14
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the XCSSET chrome_remote backdoor spawning a shell via exec.Command in response to a console.log delimiter-prefixed command, implementing a fileless reverse shell over the CDP channel.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Page 2 of 2