Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,440
11,814
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects potential beaconing activity to domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for DNS queries to known malicious domains identified during the compromise.
This rule identifies when an Azure DNS zone is either modified or deleted. This activity is detected by monitoring Azure Activity Logs for operations starting with 'MICROSOFT.NETWORK/DNSZONES' and ending with '/WRITE' (for modifications) or '/DELETE' (for deletions). Such changes can indicate malicious activity aimed at redirecting traffic or disrupting services.
This rule detects when a DNS server receives a zone transfer request for a non-existent or non-authoritative zone, indicated by EventID 6004 from the Microsoft-Windows-DNS-Server-Service. This event signifies an attempt to perform a DNS zone transfer that was rejected by the DNS server. Such attempts can be part of reconnaissance activities by adversaries trying to map out a network's DNS infrastructure.
This rule identifies when a DNS Zone is either modified or deleted within Google Cloud Platform. This activity is captured through specific Google Cloud DNS API calls: 'Dns.ManagedZones.Delete', 'Dns.ManagedZones.Update', and 'Dns.ManagedZones.Patch'. Such actions can indicate malicious activity aimed at disrupting services or redirecting traffic, or legitimate administrative changes.
This rule detects DNS queries for subdomains associated with the MEGA cloud storage service, specifically 'userstorage.mega.co.nz'. Such queries can indicate attempts to exfiltrate data to MEGA, potentially using tools like Rclone, or legitimate usage of the service. The rule focuses on the DNS layer to identify communication with this cloud storage provider.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This service can be used to upload and share files, making it a convenient target for adversaries to move stolen data out of a compromised network.
Detects DNS queries for 'anonfiles.com', which is an anonymous file upload platform frequently used for malicious purposes, including data exfiltration by malware such as BlackByte ransomware. This rule specifically looks for Event ID 3008 from the Microsoft-Windows-DNS Client Operational log, indicating a DNS query for a domain containing '.anonfiles.com'.
Detects DNS queries made by "AppInstaller.EXE" when attempting to load or install an AppX package from a referenced URL. This activity is indicative of the AppInstaller being used, which is the default handler for the "ms-appinstaller" URI scheme. This can be abused by adversaries for ingress tool transfer.
Detects DNS queries initiated by 'Regsvr32.exe'. This activity is suspicious as 'Regsvr32.exe' is a legitimate Windows utility used to register and unregister DLLs, but it is often abused by adversaries for proxy execution, defense evasion, and bypassing application control. A DNS query from this process could indicate an attempt to resolve a malicious domain for command and control or payload retrieval.
Detects DNS queries for the domain "anonfiles.com", which is an anonymous file upload platform often used by adversaries for malicious purposes, including data exfiltration. This rule specifically looks for any DNS query containing '.anonfiles.com'.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Detects suspicious DNS queries using base64 encoding
Detects strings used in command execution in DNS TXT Answer
Detects DNS queries for subdomains related to MEGA sharing website
Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL
Detects DNS server discovery via LDAP query requests from uncommon applications
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Detects suspicious DNS queries known from Cobalt Strike beacons
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Detects wannacry killswitch domain dns queries
Page 76 of 77