Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
12
Contributors
12
Categories
4
3
2
1
1
Platforms
9
3
2
Products / Services
10,844
9,798
6,760
4,421
3,776
MITRE Techniques
4
2
2
2
1
CVEs
2
2
IDS Classtypes
8
1
1
1
IDS Protocols
5
4
1
1
1
Detects the JWR phishing kit's WebSocket upgrade request to its hardcoded C2 path pattern combined with a JWRCVV-format session token, identifying the framework's persistent live-operator channel.
Detects external scanning and connection attempts against internet-exposed macOS Screen Sharing (port 5900), including mass scanning and coordinated multi-source probing, with an allowlist for known internal scanners.
Detects the RFB protocol length-field bypass frame pattern used to exploit the screensharingd pre-auth authentication bypass (CVE-2026-65400) on ports 5900/5988.
Detects JWR's real-time keystroke/card exfiltration by matching the hardcoded WebSocket C2 path token together with an instructionAck message containing instruction_id and cvv_id fields.
Detects HTTP requests to the JWR phishing framework's REST-based alternate C2 API surface, covering beaconing, exfiltration POSTs, CVV capture, instruction polling/acknowledgment, and device/IP fingerprint sync across five distinct endpoints.
Detects JSON-RPC eth_call requests to the UNC5142 EtherHiding C2 configuration contract (0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1, selector 0x1dcf296b) from non-browser clients, indicating the DeviceManager RAT resolving its C2 address via Ethereum smart contract.
Detects network retrieval of the ShieldBreak exploit PoC or the UnDefend companion tool from their known distribution infrastructure (git.projectnightcrawler.dev, github.com/Nightmare-Eclipse/UnDefend) via TLS SNI or HTTP host/URI matching.
Detects network access to known repositories hosting the publicly disclosed ShieldBreak Microsoft Defender zero-day bypass PoC/tooling (GitHub, Project Nightcrawler, Church of Malware mirrors) via HTTP host/URI or TLS SNI matching.
Detects DNS, TLS SNI, and HTTP Host traffic to the known ClickFix delivery domain karburatorotzhigi[.]com or the exact Cloudflare R2 hosting bucket subdomain pub-b7e3d7ad9f6e4b08a24cde45feeb417e.r2[.]dev used in UNC5142 campaign infrastructure.
Detects Abyssos RAT C2 traffic via its literal HELLO|...|v2.4F registration banner combined with an AES-GCM-sized payload to two known hardcoded C2 IPs.
Detects sustained outbound Stratum mining-protocol connections to Monero mining pools from a compromised host (5+ connections within 5 minutes), consistent with post-exploitation cryptomining following Screen Sharing compromise.
Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.