Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks, serving as an early warning of an ongoing vishing campaign or active extortion.
Detects network connections or web proxy requests to malicious domains (such as colafunfacts.net) known to host initial droppers, decoy pages, and payload archives for the ClickFix RAT campaigns.
Detects DNS lookups to typosquatted package registry domains for supply chain attacks
Detects DNS lookups to known cryptocurrency mining pool domains
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
This rule detects potential DNS tunneling activity by looking for an unusually high volume of DNS queries of type TXT or NULL, or DNS queries with exceptionally long names (50 characters or more), originating from multiple distinct clients within a one-hour window. This pattern is often indicative of adversaries exfiltrating data or establishing command and control through DNS.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
Privnote DNS Resolution
Cortex XDR
Identifies endpoints resolving privnote.com, a self-destructing message service abused by UNC3753 to transmit malicious installation links while bypassing chat and email filtering.
This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.
This rule detects potential Command and Control (C2) communication utilizing DNS at the application layer. It specifically looks for DNS queries and triggers an alert if a single source IP performs more than 30 DNS queries within a 60-second window, indicating a high frequency of DNS activity that could be indicative of C2.
This rule detects DNS queries that contain unusually long, seemingly random strings (50 or more alphanumeric characters) in the query name. This pattern is often used by malware for Command and Control (C2) communication, where the long string serves as 'junk data padding' to obfuscate the actual C2 data or to make detection more difficult. The rule specifically looks for DNS queries (port 53) and applies a threshold to prevent excessive alerts from a single source, triggering if 5 such queries are observed within 30 seconds from the same source IP.
This rule detects a pattern of dynamic DNS queries that could indicate Command and Control (C2) activity. Specifically, it triggers an alert if a single source IP address makes 50 or more DNS queries within a 60-second window. This high frequency of DNS lookups from a single source is often characteristic of malware attempting to resolve dynamically generated C2 domains.
Detects DNS queries to privnote.com, which UNC3753 uses to transmit self-destructing text containing malicious installation links to targets.
This rule detects DNS queries for 'pastebin.com' that occur at a high frequency (5 times within 60 seconds from the same source IP). This pattern is indicative of a Dead Drop Resolver Command and Control (C2) mechanism, where attackers use services like Pastebin to host C2 instructions or data, and malware frequently queries these services to retrieve commands or exfiltrate data. The rule specifically targets DNS traffic on port 53.
DNS Full Zone Transfer Request
Suricata
This rule detects a DNS Full Zone Transfer Request. A zone transfer is a type of DNS transaction used to replicate DNS database files (zone files) from a primary DNS server to a secondary DNS server. While legitimate for DNS server synchronization, unauthorized zone transfers can be used by attackers to gather extensive information about a network's infrastructure, including hostnames, IP addresses, and other sensitive data, which can then be used for further reconnaissance and targeting. The rule specifically looks for UDP traffic to port 53 (DNS) and the content '|00 FC|' at offset 2, which corresponds to the AXFR (Authoritative Zone Transfer) query type.
This rule detects DNS queries for Mail Exchanger (MX) records. A high volume of MX record lookups from a single source IP address within a short timeframe (10 queries in 30 seconds) is indicative of network scanning activity, specifically reconnaissance to discover mail servers. This could be a precursor to targeted attacks like phishing or email spoofing.
This rule detects a DNS incremental zone transfer request. This type of request is used to synchronize DNS zone data between DNS servers. While legitimate in some network configurations, it can also be abused by attackers during reconnaissance to gather information about a network's internal structure.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network and the dark web. Such queries indicate potential attempts to access dark web resources, which could be a policy violation or an indicator of malicious activity.
This rule detects a DNS Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic destined for port 53 (DNS) on the home network has a data size greater than 512 bytes and exceeds a threshold of 100 packets within 5 seconds, tracked by destination IP address. This pattern is indicative of a DNS amplification attack where small queries result in large responses, overwhelming the target.
This rule detects attempts to perform a DNS zone transfer. It specifically looks for UDP traffic on port 53 (DNS) destined for the home network, containing the byte sequence "|00 FC|" at an offset of 2 bytes with a depth of 2 bytes. This byte sequence corresponds to the 'AXFR' (Authoritative Zone Transfer) query type in a DNS request, which is often used by attackers for reconnaissance to enumerate DNS records for a domain.
Page 55 of 77