Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects network connections to known ShinyHunters infrastructure, including specific IP addresses and DNS queries for 'azurenetfiles.net', which has been linked to their operations targeting Oracle PeopleSoft servers via gadget chain exploitation.
SniperDz Domain IOCs
Cortex XDR
Detects network connections or DNS queries to known domain names associated with the SniperDz core monetization and redirection infrastructure. This rule specifically looks for traffic to 'win.feezossl.xyz', 'win.anababayala.com', 'aff.bnaosf1he.shop', and 'offer.raviral.com' in DNS query names or HTTP network metadata.
This rule detects network connections to subdomains of 'generate.2faplugin.org' using a regular expression. This infrastructure is associated with a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins were distributed via official channels. The regex is designed to catch varying subdomains related to this malicious infrastructure.
Detects high-rate DNS queries used for network topology and configuration discovery
Detects DNS lookups to Pastebin used for dead drop C2 configuration retrieval
Detects oversized DNS queries indicative of DNS tunneling for covert communications
This rule detects a potential DNS Reflection Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic targeting port 53 (DNS) on the home network has a data size greater than 512 bytes and occurs at a rate of 100 or more packets within a 5-second window from the same destination.
Detects dynamic domain resolution patterns used for C2 infrastructure rotation
Detects DNS lookups to dynamic DNS providers used for attack infrastructure
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.
This rule detects DNS queries to known dynamic DNS services that are frequently abused by C2 infrastructure. Specifically, it looks for queries ending in '.duckdns.org', '.no-ip.com', '.ddns.net', '.hopto.org', or '.zapto.org'. A threshold of 5 queries within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
This rule detects potential DNS exfiltration attempts by monitoring DNS query responses for specific keywords ('exfil', 'data', 'c2') in the remote DNS name. It flags devices that make 20 or more such suspicious DNS queries within an hour, indicating a high volume of potentially malicious DNS activity often associated with DNS tunneling or data exfiltration.
This rule detects devices making a high volume of DNS queries (50 or more within a 5-minute window) to domains that have 4 or more subdomains and are not common legitimate services like microsoft.com, google.com, or amazon.com. This pattern can be indicative of DNS beaconing, a technique used by adversaries for command and control (C2) communication or data exfiltration.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
This rule detects DNS queries that match a specific pattern indicative of C2 fallback domain rotation. The pattern looks for domains consisting of 8 to 12 alphanumeric characters followed by a top-level domain (TLD) from a list including .top, .xyz, .club, .icu, or .pw. This behavior is often associated with malware using domain generation algorithms (DGAs) or similar techniques for command and control communication, specifically as a fallback mechanism when primary C2 channels are disrupted.
This rule detects DNS queries for TXT records that contain a long, base64-encoded string, which could indicate a fileless payload being stored or retrieved via DNS. The rule specifically looks for TXT records with content matching a regular expression for base64-encoded strings of at least 80 characters.
Detects fast flux DNS used to rapidly rotate C2 infrastructure IPs
Detects DNS requests to known MLTBackdoor command and control and DGA domains. This rule specifically looks for DNS queries to a hardcoded list of domains associated with the MLTBackdoor malware.
ClickFix Payload Domain Network Traffic
Cortex XDR
Detects network connections or DNS queries to colafunfacts.net, a domain known to host malicious droppers disguised as logs and browser zip files in ClickFix campaigns.
This rule detects a high rate of DNS queries from a single source IP address to the local network (HOME_NET) on UDP port 53. Specifically, it triggers an alert if more than 100 DNS queries are observed from the same source within a 10-second window. This behavior is indicative of network reconnaissance, where an attacker might be rapidly querying DNS to map out internal network resources or identify potential targets.
Page 54 of 77