Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects suspicious DNS TXT record queries originating from common script interpreters (e.g., PowerShell, Python, Node.js) that are not recognized legitimate resolvers. The rule further correlates these DNS queries with subsequent process execution or network connection activity within a 60-second window, which is indicative of potential command and control (C2) communication or stager activity.
Detects network communication to well-known public DNS resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) or DNS queries for their domains, initiated by processes other than standard web browsers. This behavior is often associated with non-browser applications, potential C2 channels, or hidden network activity bypassing system DNS configurations.
Detects non-browser processes initiating HTTPS network connections to well-known public DNS over HTTPS (DoH) resolvers. This behavior is often associated with command and control (C2) communication, where malware attempts to evade network security controls by tunneling DNS queries through encrypted HTTPS traffic.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects the use of nslookup.exe to query DNS TXT records from non-Microsoft signed processes. This behavior is often associated with DNS-based Command and Control (C2) channels or data exfiltration techniques where small amounts of data are encoded within DNS TXT records.
This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects DNS queries and network connections to 'netdna-ssl.com' and its subdomains, as well as specific IP addresses (104.21.72.58, 172.67.175.240) associated with the re-registered domain. This domain was re-registered by a third party in July 2025 and now resolves legacy WP Engine CDN hostnames, creating a potential supply chain risk.
This rule detects suspicious network activity related to Tailscale mesh VPN and DuckDNS, specifically looking for resolutions of 'tailscale.com', 'wawsenti.duckdns.org', or 'duckdns.org' via DNS events, and network flow to known C2 IPs (217.154.217.139, 217.154.162.45), or traffic on UDP port 41641 within the Tailscale IP range (100.64.0.0/10). It also flags connections to 'wawsenti.duckdns.org' or any 'duckdns.org' domain in network flow data. The rule aims to identify potential C2 communications or unauthorized use of VPN services.
Detects suspicious network connections originating from processes within the AppData\Roaming folder to common web ports (80, 443), or any connection to the domain 'birdeemusic.com'. This pattern is often associated with malware establishing command and control (C2) communication or data exfiltration, especially when originating from non-browser processes.
This rule detects DNS queries for domains that exhibit characteristics of Domain Generation Algorithms (DGAs). Specifically, it looks for DNS queries where the queried domain consists of a random-looking subdomain (12 to 24 lowercase alphanumeric characters) followed by common top-level domains such as .com, .net, .org, .info, or .biz. The rule uses a thresholding mechanism to trigger an alert if 10 such queries are observed from the same source IP within a 60-second window, indicating potential DGA activity often associated with botnets or malware for command and control.
This rule detects potentially suspicious outbound network connections or DNS queries to known Generative AI service domains (OpenAI, Anthropic, Google, Mistral, Cohere) from non-browser and non-developer processes. It also triggers on suspicious Windows binaries (e.g., PowerShell, bitsadmin, mshta) initiating external connections to these domains or other destinations over port 443, helping identify potential data exfiltration or automated abuse of LLM APIs.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.
This rule detects potential engagement with known phishing infrastructure by monitoring common email clients and browsers for DNS resolutions to specific malicious domains (holabrief.com, loopedin.io) or network connections to suspicious IP addresses associated with a healthcare-themed phishing campaign.
Detects DNS lookups targeting the .xyz TLD indicative of Potemkin DGA behavior, specifically when initiated by 'RunSearch.exe'. The regex identifies domain names with a pattern of 2 or 3 hyphen-separated alphanumeric strings, followed by the .xyz TLD.
Detects outbound network connections or DNS lookups to domains associated with the Bluekit Phishing-as-a-Service (PhaaS) platform. This activity often indicates communication with decentralized peer-to-peer phishing infrastructure or Command and Control (C2) domains utilized for phishing campaigns.
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects DNS tunneling used for covert C2 communications
This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.
Page 52 of 77