Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
7
2
Contributors
7
2
Categories
3
3
2
2
2
Platforms
9
2
Products / Services
6
4
1
1
1
MITRE Techniques
6
5
5
3
2
CVEs
71
71
64
58
49
Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.
Detects an unexpected file deletion by the dns.exe process. This activity could indicate remote code execution or other forms of exploitation, potentially related to vulnerabilities like CVE-2020-1350 (SigRed), where an attacker might manipulate DNS server files.
Detects an unexpected process spawning from dns.exe, which may indicate activity related to remote code execution or other forms of exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out legitimate child processes like conhost.exe.
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
This analytic detects the presence of SIGRed (CVE-2020-1350), a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. It identifies specific DNS query types (SIG and KEY) and checks for high data transfer within a flow (over 65KB). This detection is significant because SIGRed allows attackers to execute remote code on Windows DNS servers, potentially leading to unauthorized access and control. If confirmed malicious, this activity could result in data exfiltration, service disruption, or further network compromise. Immediate investigation and mitigation, such as patching or isolating the affected server, are crucial.
The analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. It leverages Splunk Stream DNS and TCP data to identify DNS SIG and KEY records, as well as TCP payloads exceeding 65KB. This activity is significant because SIGRed is a critical wormable vulnerability that allows remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially disrupt services, leading to severe data breaches and infrastructure compromise. Immediate investigation and remediation are crucial to mitigate these risks.
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.