Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects high-volume, established TLS connections to common public DNS-over-HTTPS (DoH) providers (Google, Cloudflare, OpenDNS). Persistent high-frequency connections to these resolvers can be indicative of DNS tunneling, where an adversary encapsulates command-and-control or data exfiltration traffic within encrypted DNS queries to bypass network monitoring.
Detects high-frequency DNS queries for long, random-looking subdomains that result in NXDomain responses, a behavioral indicator of malware using Domain Generation Algorithms (DGA) for command-and-control beaconing.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
Detects anomalous svchost.exe behavior involving the use of libjpeg-turbo compression function symbols in the command line, alongside potential C2 communication with a known suspicious domain (kkxqbh.top) or connection over non-standard ports, which may indicate malicious exfiltration or data staging.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects evidence of LCRYX ransomware activity, specifically identifying beaconing behavior via a 'ping.exe' loop targeting the 'ragebot.fun' domain, and the execution of suspicious Visual Basic scripts (systemconfig.exe.vbs) via wscript or cscript, which are often used for stage-loading malicious payloads.
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
Detects network connections to known ShinyHunters infrastructure, identified by specific IP addresses and DNS queries for 'azurenetfiles.net'. This activity is associated with the exploitation of Oracle PeopleSoft servers via gadget chain exploitation.
A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).
Detects DNS resolution of known Bluekit PhaaS (Phishing-as-a-Service) operator domains. These domains are associated with phishing lures that leverage LLMs for localized content and voice cloning, and this detection identifies when a host attempts to resolve these specific malicious domains, indicating a likely interaction with a phishing lure.
This rule detects activities associated with specific malicious browser extensions, often masquerading as ad blockers. It monitors for file and command-line references to the unique extension IDs associated with these malicious payloads and also alerts on DNS requests directed at C2 domains known to be used by these extensions.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
This rule monitors network logs (DNS, Proxy, or general network traffic) for communication with TON (The Open Network) blockchain-related infrastructure, including known C2 domains associated with TONResolver and specific blockchain API queries. It flags connections made by suspicious processes such as node.exe, powershell, wscript, cscript, or mshta, which are often used by malware to execute scripts or facilitate C2 communication.
Detects instances where node.exe is launched from common user-mode applications (like browsers or shells) and executes a JavaScript file from temporary or user application data directories, followed by a DNS request to domains associated with high-risk TLDs (shop, bond, sbs, cfd). This behavior is characteristic of certain remote access trojans (RATs) that utilize node.js for secondary payloads.
Detects DNS queries for known TON blockchain related domains or rare top-level domains (shop, bond, sbs, cfd) initiated by common script interpreters or runtime processes like PowerShell, node, cmd, or wscript. This activity is often associated with the TONResolver, which may be used by malware for C2 communications, dead-drop resolution, or as a post-resolution staging mechanism.
This rule monitors for suspicious emails involving the 'gasparinutrition.com' domain, specifically looking for indicators such as DMARC failures, spoofed display names (e.g., 'monitoring'), or attachments with file names related to business documents like distribution, settlement, or agreements. It also triggers on DNS queries for the same domain, which could indicate related outbound communications or C2 activity.
Page 50 of 77