Detections

Explore public detection logic contributed by the community across SIEM and rule languages.

2 detections

Detects C2Looper v2 retrieving GitHub-hosted C2 tasking files (cmd.json, result.json, beacon.json) via raw.githubusercontent.com or api.github.com, requiring repeated requests to reduce false positives from incidental single fetches.
avatar
Duo Tech@duotech
avatar
Detections.ai Community
2 months ago
000
Detects the Hermes Agent/DeepSeek autonomous CVE-research pivot pattern — proxy traffic showing both a GitHub trending-PoC search sorted by stars and a CVSS/exploitability scoring pipeline query, indicating autonomous vulnerability research and target re-selection after a failed exploitation attempt.
avatar
Duo Tech@duotech
avatar
Detections.ai Community
3 months ago
0011