Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
Detects high-frequency DNS queries for long, random-looking subdomains that result in NXDomain responses, a behavioral indicator of malware using Domain Generation Algorithms (DGA) for command-and-control beaconing.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.
Detects DNS queries for 14-character alphanumeric .org domains characteristic of Bumblebee malware's Domain Generation Algorithm (DGA).
This rule detects DNS queries for domains that exhibit characteristics of Domain Generation Algorithms (DGAs). Specifically, it looks for DNS queries where the queried domain consists of a random-looking subdomain (12 to 24 lowercase alphanumeric characters) followed by common top-level domains such as .com, .net, .org, .info, or .biz. The rule uses a thresholding mechanism to trigger an alert if 10 such queries are observed from the same source IP within a 60-second window, indicating potential DGA activity often associated with botnets or malware for command and control.
This rule detects DNS queries to known dynamic DNS providers, which can be indicative of Command and Control (C2) infrastructure. Adversaries often use dynamic DNS services to maintain persistent access to compromised systems, as the IP addresses of their C2 servers may change frequently. The rule specifically looks for queries containing domains like duckdns.org, no-ip.com, ddns.net, hopto.org, zapto.org, and sytes.net.
This rule detects a multi-stage command and control (C2) domain rotation pattern by identifying DNS queries for domains that match a specific regular expression. The pattern looks for domains consisting of 6 to 12 lowercase alphanumeric characters followed by one of several top-level domains (xyz, top, icu, club, online). A threshold of 5 such queries from the same source within 60 seconds is used to trigger the alert, indicating potential malicious activity like fast flux or domain generation algorithms (DGAs) used by malware for C2 communication.
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.
This rule detects DNS queries to known dynamic DNS services that are frequently abused by C2 infrastructure. Specifically, it looks for queries ending in '.duckdns.org', '.no-ip.com', '.ddns.net', '.hopto.org', or '.zapto.org'. A threshold of 5 queries within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
This rule detects DNS queries that match a specific pattern indicative of C2 fallback domain rotation. The pattern looks for domains consisting of 8 to 12 alphanumeric characters followed by a top-level domain (TLD) from a list including .top, .xyz, .club, .icu, or .pw. This behavior is often associated with malware using domain generation algorithms (DGAs) or similar techniques for command and control communication, specifically as a fallback mechanism when primary C2 channels are disrupted.
This rule detects DNS queries for TXT records that contain a long, base64-encoded string, which could indicate a fileless payload being stored or retrieved via DNS. The rule specifically looks for TXT records with content matching a regular expression for base64-encoded strings of at least 80 characters.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
This rule detects potential Command and Control (C2) communication utilizing DNS at the application layer. It specifically looks for DNS queries and triggers an alert if a single source IP performs more than 30 DNS queries within a 60-second window, indicating a high frequency of DNS activity that could be indicative of C2.
This rule detects DNS queries that contain unusually long, seemingly random strings (50 or more alphanumeric characters) in the query name. This pattern is often used by malware for Command and Control (C2) communication, where the long string serves as 'junk data padding' to obfuscate the actual C2 data or to make detection more difficult. The rule specifically looks for DNS queries (port 53) and applies a threshold to prevent excessive alerts from a single source, triggering if 5 such queries are observed within 30 seconds from the same source IP.
This rule detects a pattern of dynamic DNS queries that could indicate Command and Control (C2) activity. Specifically, it triggers an alert if a single source IP address makes 50 or more DNS queries within a 60-second window. This high frequency of DNS lookups from a single source is often characteristic of malware attempting to resolve dynamically generated C2 domains.
This rule detects DNS queries for 'pastebin.com' that occur at a high frequency (5 times within 60 seconds from the same source IP). This pattern is indicative of a Dead Drop Resolver Command and Control (C2) mechanism, where attackers use services like Pastebin to host C2 instructions or data, and malware frequently queries these services to retrieve commands or exfiltrate data. The rule specifically targets DNS traffic on port 53.
Page 12 of 16