Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
27
Contributors
27
Categories
12
5
4
3
3
Platforms
24
3
1
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
11
4
4
3
3
IDS Classtypes
16
10
IDS Protocols
10
7
5
3
1
Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.
Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.
Detects successful DNS resolution responses, TLS SNI values, and HTTP Host headers referencing known Shai-Hulud/Miasma token-jacking transfer station infrastructure (amutes.com, abb1.life) used by attackers to resell stolen AI/LLM API access via gray-market proxy services.
STAC4749 Golang Implant TLS Certificate with Hardcoded CA Issuer (loop-CA/connectify-CA/james-bond-CA)
STAC4749 sc5.exe reverse SOCKS proxy C2 domain query (legio.name)
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
Page 2 of 2