Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
67 detections
Filters
Last updated
All Time
Detection languages
35
22
5
4
1
Contributors
28
9
9
6
4
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
41
19
6
5
1
Products / Services
25
25
10
7
6
MITRE Techniques
39
32
16
7
5
IDS Classtypes
11
5
3
2
1
IDS Protocols
17
5
Detects unauthorized DNS server responses used for infrastructure setup
Detects unauthorized DNS server responses used for infrastructure setup
This rule detects potential DNS exfiltration attempts by monitoring DNS query responses for specific keywords ('exfil', 'data', 'c2') in the remote DNS name. It flags devices that make 20 or more such suspicious DNS queries within an hour, indicating a high volume of potentially malicious DNS activity often associated with DNS tunneling or data exfiltration.
This rule detects DNS responses with a very low Time-To-Live (TTL) value, which is a characteristic often associated with fast flux techniques used by malware to rapidly change IP addresses. Specifically, it looks for UDP traffic on port 53 (DNS) where the DNS response contains a specific content pattern indicating a low TTL.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
This rule detects potential rogue DNS server activity by monitoring UDP traffic on port 53 (DNS) to the home network. It specifically looks for DNS query responses (indicated by the content "|84 80|") and triggers an alert if 20 such responses are observed from the same source IP within a 30-second window. This behavior could indicate an unauthorized or malicious DNS server attempting to respond to client queries.
This rule detects potential DNS response spoofing or DNS hijacking attempts. It specifically looks for UDP traffic on port 53 (DNS) where a high number of responses (5 within 10 seconds) are observed for a given destination IP address, which could indicate an attacker attempting to inject malicious DNS responses.
This rule detects unauthorized DNS server responses originating from external hosts. Specifically, it looks for UDP traffic on port 53 (DNS) with a specific content signature '|84 00|' at an offset of 2 bytes and a depth of 2 bytes, which corresponds to a DNS response header indicating a standard query response. The rule uses a threshold to alert if 10 such responses are observed from the same source within 30 seconds, suggesting a potential unauthorized or malicious DNS activity.
This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (V4dC5FbmNvZ) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (dm9rZS1SZXN0TWV0) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (Zva2UtUmVzdE1ld) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (2b2tlLVJlc3RNZX) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (leHQuRW5jb2) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
_ldap._tcp.dc._msdcs.ad.domain.com is a DNS query used by AD clients to locate Domain Controllers that can provide LDAP services for the ad.domain.com domain, ensuring users and computers can authenticate, query directory data, and function inside the AD forest.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
Time to live (TTL) values in DNS responses provide valuable threat-hunting insights, including:
- Fast-flux botnets (rotating IPs with low TTLs).
- Malware C2 detection (extremely low TTLs). ( | where TTLs < 10 )
- DNS tunneling (high TTLs or changing TTLs). ( | where TTLs > 86400 )
- Fake domains mimicking real services (TTL anomalies).
- Evasive infrastructure constantly changing TTL values.
You can use the following KQL Query to search for the mentioned cases.
- Fast-flux botnets (rotating IPs with low TTLs).
- Malware C2 detection (extremely low TTLs). ( | where TTLs < 10 )
- DNS tunneling (high TTLs or changing TTLs). ( | where TTLs > 86400 )
- Fake domains mimicking real services (TTL anomalies).
- Evasive infrastructure constantly changing TTL values.
You can use the following KQL Query to search for the mentioned cases.
KQL Query from file: Direct Send Abuse Detection
This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign.
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query detects events when Nobelium received a DNS response after launching a lookup request to known command-and-control infrastructure.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query detects events when Nobelium received a DNS response after launching a lookup request to known command-and-control infrastructure.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign.
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query detects events when Nobelium received a DNS response after launching a lookup request to known command-and-control infrastructure.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query detects events when Nobelium received a DNS response after launching a lookup request to known command-and-control infrastructure.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Page 3 of 4