Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,440
11,814
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects suspicious DNS queries to known Monero mining pools, indicating potential cryptocurrency mining activity on the network. This rule identifies specific domain names associated with various Monero mining operations.
Detects suspicious DNS queries to Monero mining pools
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
This rule detects DNS queries to specific domains identified as indicators of compromise (IOCs) associated with the Diamond Sleet APT group. The domains '3dkit.org', 'dersmarketim.com', 'galerielamy.com', and 'olidhealth.com' are known to be used by this threat actor for command and control (C2) communications. Monitoring for these specific DNS queries can help identify systems potentially compromised by Diamond Sleet.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS queries starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS command and control (C2) communication.
This rule detects suspicious DNS queries where the Z flag bit in the DNS protocol header is set to a non-zero value. The Z flag is reserved (unused) per IETF design, though it has recently been used in DNSSec. A non-zero Z flag value should be rare outside of legitimate DNSSec usage. The rule includes exclusions for common TLDs, query types (NS, MX), responses, and NetBIOS related traffic to reduce false positives. The rule's intent is to identify potential command and control (C2) or data exfiltration attempts leveraging DNS anomalies.
This rule identifies DNS queries made to domains associated with known cryptocurrency mining pools. It specifically looks for DNS queries where the 'query' field ends with any of the listed mining pool domains. The rule excludes queries with answers '127.0.0.1' or '0.0.0.0' and those marked as rejected, to reduce false positives. The primary goal is to detect potential resource hijacking through cryptomining on compromised systems.
Detects suspicious DNS queries that contain a base64 encoded string, indicated by the '==.' pattern. This pattern is often used in DNS exfiltration techniques where data is encoded in base64 and sent via DNS queries to bypass network defenses.
This rule detects suspicious DNS queries specifically targeting 'api.telegram.org'. This domain is used by Telegram Bot API, which can be leveraged by various types of malware (e.g., RATs, ransomware) for command and control (C2) or data exfiltration. Monitoring these queries helps identify systems potentially communicating with malicious Telegram bots.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS query names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beaconing activity. Specifically, it looks for DNS queries with names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
This rule detects attempts to discover DNS servers within a network using LDAP queries. Specifically, it looks for DNS queries where the query name starts with '_ldap.' and the query originates from an uncommon or suspicious application. The rule filters out queries from common system processes, known legitimate applications (like Microsoft Defender), and browsers to reduce false positives. The intent is to identify adversaries performing reconnaissance to map out network infrastructure.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' attacks, which targeted iOS devices. These domains were revealed by Kaspersky and the FSB.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.
Detects DNS queries for subdomains related to the MEGA cloud storage service. This activity can indicate data exfiltration to cloud storage, potentially using tools like Rclone.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.
This rule detects DNS queries made by the Azure Hybrid Connection Manager service to the Azure Service Bus service. This activity is considered suspicious because it could indicate an attempt to establish persistence or exfiltrate data through a compromised Hybrid Connection Manager, leveraging the Service Bus as a communication channel.
This rule detects DNS queries to specific malicious domains associated with the GALLIUM threat group, as identified by Microsoft Threat Intelligence Center in December 2019. The rule specifically looks for Event ID 257 in the Microsoft-Windows-DNS-Server/Analytical log, where the queried domain name (QNAME) matches a predefined list of indicators.
Page 75 of 77