Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
67 detections
Filters
Last updated
All Time
Detection languages
35
22
5
4
1
Contributors
28
9
9
6
4
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
41
19
6
5
1
Products / Services
25
25
10
7
6
MITRE Techniques
39
32
16
7
5
IDS Classtypes
11
5
3
2
1
IDS Protocols
17
5
The analytic identifies excessive DNS query failures by counting DNS responses that do not indicate success, triggering when there are more than 50 occurrences. It leverages the Network_Resolution data model, focusing on DNS reply codes that signify errors. This activity is significant because a high number of DNS failures can indicate potential network misconfigurations, DNS poisoning attempts, or malware communication issues. If confirmed malicious, this activity could lead to disrupted network services, hindered communication, or data exfiltration attempts by attackers.
This analytic identifies suspicious DNS TXT records using a pre-trained deep learning model. It leverages DNS response data from the Network Resolution data model, categorizing TXT records into known types via regular expressions. Records that do not match known patterns are flagged as suspicious. This activity is significant as DNS TXT records can be used for data exfiltration or command-and-control communication. If confirmed malicious, attackers could use these records to covertly transfer data or receive instructions, posing a severe threat to network security.
Detects DNS TXT records containing strings commonly used for command execution, such as 'IEX' (Invoke-Expression), 'Invoke-Expression', and 'cmd.exe'. This technique can be used by adversaries for command and control (C2) or data exfiltration by embedding commands within DNS responses.
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. Specifically looks for messages related to dropping source port zero packets, denied AXFR requests, and fatal errors causing an exit.
Page 4 of 4