Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
101
Contributors
36
24
19
13
6
Categories
45
34
24
23
23
Platforms
88
16
4
4
3
Products / Services
97
56
7
2
2
MITRE Techniques
39
25
17
17
14
CVEs
1
IDS Classtypes
1,937
503
461
381
236
101
IDS Protocols
43
41
8
3
2
Detects DNS queries targeted towards specific '2miners.com' solo mining pool subdomains (e.g., solo-zeph.2miners.com, solo-rvn.2miners.com). Such activity is often associated with unauthorized cryptocurrency mining (cryptojacking) performed on compromised systems.
Detects anomalous ICMP Echo Request packets (Type 8) directed towards external networks that contain a payload size greater than 128 bytes. Such anomalies are often indicative of ICMP tunneling, which may be leveraged by adversaries for command and control (C2) communication or data exfiltration.
Detects DNS query traffic with unusually long subdomains (over 100 characters) that exhibit Base64-like encoding patterns. This is a common behavioral indicator for DNS tunneling tools like iodine or dnscat2, which use DNS queries to encapsulate non-DNS protocol traffic for command and control or data exfiltration.
This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.
This rule monitors DNS query traffic for unusually long, encoded subdomain labels (50 characters or more). Such patterns are indicative of data exfiltration or command-and-control (C2) communication using DNS tunneling tools like iodine or dnscat2, which encapsulate non-DNS protocols within the DNS query structure to evade network inspection.
Detects DNS queries containing unusually long subdomains (50+ characters) encoded in Base64, which is a common technique used for command-and-control (C2) communication or data exfiltration via DNS tunneling.
This rule detects ICMP Echo Request (type 8) packets with an unusually large payload (greater than 64 bytes). Such anomalies often indicate that an adversary is using ICMP as a covert channel for command-and-control (C2) communications or data exfiltration, by embedding arbitrary data within the ICMP payload fields.
Detects high-frequency ICMP Echo Requests (Type 8) directed from internal networks to external destinations with oversized payloads (greater than 200 bytes). This pattern is indicative of ICMP tunneling, which is often used by adversaries for covert command-and-control (C2) communications or data exfiltration, bypassing standard filtering or monitoring.
Detects high-frequency ICMP Echo Requests (Type 8) directed from internal networks to external destinations with oversized payloads (greater than 200 bytes). This pattern is indicative of ICMP tunneling, which is often used by adversaries for covert command-and-control (C2) communications or data exfiltration, bypassing standard filtering or monitoring.
Detects anomalous ICMP Echo Request packets (Type 8) directed towards external networks that contain a payload size greater than 128 bytes. Such anomalies are often indicative of ICMP tunneling, which may be leveraged by adversaries for command and control (C2) communication or data exfiltration.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
This rule monitors DNS query traffic for unusually long, encoded subdomain labels (50 characters or more). Such patterns are indicative of data exfiltration or command-and-control (C2) communication using DNS tunneling tools like iodine or dnscat2, which encapsulate non-DNS protocols within the DNS query structure to evade network inspection.
This rule detects ICMP Echo Request (type 8) packets with an unusually large payload (greater than 64 bytes). Such anomalies often indicate that an adversary is using ICMP as a covert channel for command-and-control (C2) communications or data exfiltration, by embedding arbitrary data within the ICMP payload fields.
Detects ICMP Type 8 (Echo Request) packets with a payload size exceeding 1000 bytes. This is a common indicator of ICMP tunneling, where attackers encapsulate data within ICMP packets to bypass network security controls for command and control or data exfiltration.
Detects ICMP Type 8 (Echo Request) packets with a payload size exceeding 1000 bytes. This is a common indicator of ICMP tunneling, where attackers encapsulate data within ICMP packets to bypass network security controls for command and control or data exfiltration.
Detects DNS queries containing unusually long subdomains (50+ characters) encoded in Base64, which is a common technique used for command-and-control (C2) communication or data exfiltration via DNS tunneling.
This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.
This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.
This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.
Page 3 of 5