Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
37
17
7
2
2
Contributors
16
14
10
7
3
Categories
19
15
14
13
10
Platforms
39,908
7,245
6,529
3,864
3,627
66
Products / Services
16
8
8
7
6
MITRE Techniques
17
14
9
9
7
IDS Classtypes
4
3
IDS Protocols
5
2
This detection identifies network requests matching a URL pattern used by the Coruna iOS exploit kit to deliver encrypted binary payloads. The framework generates resource URLs using a 40-character hash and serves them as files ending in ".min.js".
Detects network connections to domains identified as being part of the DarkSword iOS exploit kit delivery or command-and-control infrastructure. The DarkSword exploit kit is actively being used by multiple threat actors (UNC6353, UNC6748, PARS Defense) to target iOS users.
Detects specific log messages written to the iOS Unified Log by the DarkSword implant (GHOSTBLADE). These messages, which include tags like '[DarkSword-WIFI-DUMP]' and '[MAIN]', are unique to the malware and indicate that the data exfiltration modules are running. The GHOSTBLADE implant, used by UNC6353 in the DarkSword campaign, leaves distinct and high-confidence log messages in iOS Unified Logs during its operation. These logs are a clear indicator of a successful compromise.
Detects web requests for specific JavaScript file names that are part of the DarkSword iOS exploit chain. The presence of these requests strongly suggests a device is being targeted with the exploit kit.
Detects the creation of temporary files used by the DarkSword implant to stage stolen data before exfiltration. After exploiting the device, the DarkSword implants copy sensitive user data to temporary files. Detecting the creation of these specific staging files is a strong indicator of compromise.
Detects multiple crashes from key iOS system processes within a short time window. This pattern is indicative of a failed memory corruption attempt, consistent with the sandbox escape and privilege escalation techniques used by the DarkSword exploit kit.
Detects process command lines containing strings characteristic of the GHOSTBLADE dataminer, a payload deployed by UNC6353 via the DarkSword exploit. These strings are hardcoded file paths used for data collection and exfiltration.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects DNS queries for domains that match the pattern used by the PLASMAGRID malware's Domain Generation Algorithm (DGA). This malware, delivered by the Coruna iOS exploit kit, uses a DGA seeded with "lazarus" to generate 15-character domains with a ".xyz" TLD for command and control fallback.
Detects network connections to known command-and-control (C2) and distribution domains associated with the Coruna exploit kit campaigns. This includes the domain used in the Ukrainian campaign by UNC6353 and the larger set from the financially motivated UNC6691 group.
Detects the PLASMAGRID implant and its modules by their SHA-256 hash values. The implant is the final payload of the Coruna exploit kit, designed to steal cryptocurrency and other financial information from compromised iOS devices.
Intellexa PREYHUNTER - HTTP
Suricata
Intellexa PREYHUNTER - HTTP response contains distinctive iOS build/artifact strings
This detection is designed to help you find activity related to Intellexa Predator /
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
Detects the presence of a unique build path artifact associated with the PREYHUNTER iOS spyware stager, used by the commercial surveillance vendor Intellexa.
Detects network traffic to infrastructure associated with newly identified front companies linked to the Intellexa Predator spyware syndicate.
Detects the PREYHUNTER 'watcher' module performing anti-analysis checks by launching common security, forensic, or shell tools.
Detects unique strings associated with the JSKit iOS exploitation framework in network traffic. This framework is used by multiple threat actors, including the commercial surveillance vendor Intellexa, to deliver spyware like Predator.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a public GitHub repository and then checks if a specified IP address is contained within any of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
Detecting networks shared by phones with key words in their Names such as "FREE", "AIRPORT" "OPEN", can be potential cases of Evil Twin Attack where malicious actors can intercept network traffic, steal login credentials, capture sensitive data, or launch further attacks like Man-in-the-Middle (MitM) attacks.
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
KQL Query
Page 3 of 4