Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
This rule detects potential command and control (C2) activity leveraging DNS tunneling. It identifies high-frequency DNS queries that contain unusually long subdomain labels (51 characters or more), which is a common technique used to encode data or commands within DNS protocol traffic to bypass network security controls.
This rule detects potentially malicious DNS traffic where queries contain exceptionally long, encoded, or randomized subdomains. Attackers often use these patterns to exfiltrate data from a target network, bypassing traditional security controls by encapsulating information within DNS requests (DNS tunneling). The detection looks for DNS queries exceeding 100 bytes in length with specific character patterns indicative of Base64 or similar encoding.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.
Detects DNS queries for domains ending in '.trycloudflare.com', which are commonly used to establish unauthorized remote access tunnels (Cloudflare Tunnel) by threat actors for C2 communication.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
Detects DNS TXT query responses containing anomalously large RDATA payloads (exceeding 100 bytes). Large TXT records are frequently used in DNS tunneling or data exfiltration scenarios to smuggle data out of a network while bypassing traditional network security controls. The rule applies a threshold limit to identify persistent, potentially malicious exfiltration activity from a specific source over a 60-second window.
This rule monitors DNS query traffic for unusually long, encoded subdomain labels (50 characters or more). Such patterns are indicative of data exfiltration or command-and-control (C2) communication using DNS tunneling tools like iodine or dnscat2, which encapsulate non-DNS protocols within the DNS query structure to evade network inspection.
This rule detects potential command and control (C2) beaconing activity using DNS by identifying high-frequency, long, and random subdomain queries. It monitors for DNS requests that exceed 40 bytes in size, feature complex alphanumeric subdomains, and exceed a defined threshold of 10 requests within a 60-second window, which is indicative of DNS tunneling or command-and-control exfiltration.
Detects DNS queries containing unusually long subdomains (50+ characters) encoded in Base64, which is a common technique used for command-and-control (C2) communication or data exfiltration via DNS tunneling.
Detects DNS queries for domains ending in '.trycloudflare.com', which are commonly used to establish unauthorized remote access tunnels (Cloudflare Tunnel) by threat actors for C2 communication.
This rule detects potentially malicious DNS traffic where queries contain exceptionally long, encoded, or randomized subdomains. Attackers often use these patterns to exfiltrate data from a target network, bypassing traditional security controls by encapsulating information within DNS requests (DNS tunneling). The detection looks for DNS queries exceeding 100 bytes in length with specific character patterns indicative of Base64 or similar encoding.
This rule detects potential command and control (C2) beaconing activity using DNS by identifying high-frequency, long, and random subdomain queries. It monitors for DNS requests that exceed 40 bytes in size, feature complex alphanumeric subdomains, and exceed a defined threshold of 10 requests within a 60-second window, which is indicative of DNS tunneling or command-and-control exfiltration.
This rule detects potential command and control (C2) activity leveraging DNS tunneling. It identifies high-frequency DNS queries that contain unusually long subdomain labels (51 characters or more), which is a common technique used to encode data or commands within DNS protocol traffic to bypass network security controls.
This rule detects potential command and control (C2) beaconing activity using DNS tunneling. It monitors for a high frequency of DNS TXT record queries to long subdomains (exceeding 50 characters), which is a common characteristic of tools like DNScat and iodine that encode data within DNS requests.
This rule detects potential DNS exfiltration attempts by identifying DNS queries containing high-entropy subdomains of 51 characters or more, encoded in Base64. Adversaries may use long, encoded subdomains to tunnel data out of a network through the DNS protocol, bypassing traditional security controls.
This rule monitors DNS traffic for queries to the domain 'chongdaotang.net', which is associated with a phishing campaign leveraging legal threat lures to harvest credentials. Detecting these queries indicates that a host in the network is attempting to resolve a domain used in a known credential harvesting attack.
Detects DNS TXT queries for the domain '_axiom-config.m100.cloud', which is associated with fileless payload retrieval techniques.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Page 11 of 16