Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
8
Contributors
8
Categories
7
1
1
Platforms
8
1
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
3
3
2
2
2
IDS Classtypes
4
2
1
1
IDS Protocols
6
2
Detects a high-volume DNS TXT-record query flood (200+ queries in 5 minutes) to a single destination, excluding common legitimate high-volume TXT consumers (SPF/DKIM/DMARC validators), indicative of DNS tunneling.
Detects payload callbacks to the Rognar Telegram-bot-linked DOUBLECUP C2 URL (hxxp://67.219.107.181/hgflssvslvidfugvbldiuv).
Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Detects DeviceManager DNS TXT/A tunneling traffic occurring within 60 seconds after an eth_call blockchain RPC request from the same host, consistent with DeviceManager resolving C2 via EtherHiding before tunneling.
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
Detects an HTTP POST to an IP-literal host occurring after an eth_call blockchain RPC lookup from the same host, consistent with DeviceManager/DOUBLECUP resolving and beaconing to a C2 address extracted from blockchain-sourced configuration.
Detects DOUBLECUP's session polling/telemetry beacon to /session/reg, /session/check, and /session/signal with a sid= query parameter, requiring at least 5 requests within 15 seconds to match the malware's 1.2-3 second polling cadence.