Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,440
11,814
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects potential DNS tunneling or Command and Control (C2) communication patterns. The rule calculates subdomain entropy to identify unusually long or randomized subdomain labels, monitors for excessive DNS query volume per client, and flags the use of specific record types (TXT, NULL) often associated with C2 frameworks like dnscat2 or iodine.
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
This rule detects network connections or DNS queries made to suspicious domains that utilize MFA or credential-themed keywords (e.g., 'mfa', 'sso', 'passkey', 'register'). These domains are often used in phishing campaigns to impersonate authentication portals and harvest user credentials or MFA tokens.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with the known exfiltration domain 't.m-kosche.com' linked to the Mini Shai-Hulud malware.
Detects network activity associated with the ErrTraffic malware, specifically targeting JSON-RPC 'eth_call' requests to Polygon blockchain smart contracts used for C2 resolution and subsequent DNS queries to known malicious domains used for C2 infrastructure.
This rule identifies suspicious command and control (C2) activity by monitoring network connections to specific known malicious domains, detection of specific authentication tokens in process command lines, and the use of spoofed User-Agent strings associated with predefined C2 URI paths.
This rule identifies suspicious command and control (C2) activity by monitoring network connections to specific known malicious domains, detection of specific authentication tokens in process command lines, and the use of spoofed User-Agent strings associated with predefined C2 URI paths.
This rule identifies suspicious command and control (C2) activity by monitoring network connections to specific known malicious domains, detection of specific authentication tokens in process command lines, and the use of spoofed User-Agent strings associated with predefined C2 URI paths.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects network traffic (DNS queries, TLS SNI, and HTTP Host headers) associated with the known TukTuk C2 infrastructure domain 'borjumaniya.store'.
Sweeps Defender Advanced Hunting telemetry for known Sauron Loader indicators: 5 malicious SHA256 hashes (MSI installer, rnp.dll loader, tdwp.dll decrypter, embedded RSA private/public key blobs) across file/process/image-load events, plus 4 C2 domains and their full URLs across network and DNS telemetry. No IP indicators were published in the source reporting (C2 is domain-based over HTTPS) — the IP bucket is intentionally omitted rather than filled with placeholder data.
This rule monitors network traffic and DNS queries to identify endpoints attempting to connect to known cryptocurrency scam domains. It correlates data from DeviceNetworkEvents and DnsEvents to capture both direct network connections and DNS resolution attempts.
Detects network and DNS activity associated with the SideCopy threat group, specifically monitoring for connections to known C2 domains, C2 IP addresses, or the usage of port 5863 typically associated with the ReverseRAT backdoor.
This rule correlates multiple telemetry sources (File Events, Certificate Info, Network Events, and DNS Events) to detect known malicious indicators, including specific file hashes, IP addresses, domains, and URLs associated with malicious activity.
This rule correlates multiple telemetry sources (File Events, Certificate Info, Network Events, and DNS Events) to detect known malicious indicators, including specific file hashes, IP addresses, domains, and URLs associated with malicious activity.
This rule identifies DNS queries or web requests directed toward a known list of domain names associated with the 'ShipmentsFree' family of shipping-rebate scams. These scams are typically designed to lure consumers into unknowingly signing up for recurring, undisclosed subscription services.
This rule identifies DNS queries or web requests directed toward a known list of domain names associated with the 'ShipmentsFree' family of shipping-rebate scams. These scams are typically designed to lure consumers into unknowingly signing up for recurring, undisclosed subscription services.
This rule identifies DNS queries or web requests directed toward a known list of domain names associated with the 'ShipmentsFree' family of shipping-rebate scams. These scams are typically designed to lure consumers into unknowingly signing up for recurring, undisclosed subscription services.
Page 15 of 77