Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
This rule detects DNS queries for Mail Exchanger (MX) records. A high volume of MX record lookups from a single source IP address within a short timeframe (10 queries in 30 seconds) is indicative of network scanning activity, specifically reconnaissance to discover mail servers. This could be a precursor to targeted attacks like phishing or email spoofing.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network and the dark web. Such queries indicate potential attempts to access dark web resources, which could be a policy violation or an indicator of malicious activity.
This rule detects DNS queries for TXT records that contain specific patterns indicative of DNS calculation C2 (Command and Control) activity. The pattern searched for is a PCRE regex matching two alphanumeric strings, each 4 to 8 characters long, separated by a dot (e.g., 'abcd.efgh.'). This type of activity is often associated with malware using DNS TXT records to encode C2 instructions or data, potentially involving IP math for dynamic C2 server resolution. The rule includes a threshold to prevent excessive alerts, triggering if 5 such queries are observed from the same source within 60 seconds.
This rule detects DNS queries for typosquatted domains related to npmjs. Specifically, it looks for queries to domains ending in 'npmjs.net', 'npmjs.org', 'npmjs.io', or 'npmjs.co'. This is indicative of potential supply chain attacks or attempts to trick users into downloading malicious packages from fake registries.
This rule detects DNS queries to 'discord.com' with a high frequency (20 queries within 60 seconds from the same source IP). This behavior is indicative of Command and Control (C2) activity leveraging Discord webhooks, as described in MITRE ATT&CK technique T1102. Attackers often use legitimate services like Discord for C2 to blend in with normal network traffic and evade detection.
This rule detects DNS queries for domains that resemble update servers used in the SolarWinds supply chain attack. Specifically, it looks for DNS queries containing 'update' followed by 'solarwinds', 'orion', 'avupdate', or 'antivirus' in the domain name. This pattern was associated with the SUNBURST backdoor's communication with its command and control infrastructure.
This rule detects unusually long DNS queries (40 characters or more) which can be indicative of DNS tunneling. DNS tunneling is a technique used by adversaries for command and control (C2) communication or data exfiltration, where data is encoded within DNS queries and responses to bypass network security controls.
This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.
This rule detects DNS queries for top-level domains (TLDs) commonly associated with bulletproof hosting services. Specifically, it looks for queries ending in .ru, .cn, .tk, .ml, .ga, .cf, or .gq. A threshold of 20 queries within 60 seconds from the same source IP will trigger an alert.
This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.
This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.
This rule detects DNS queries for known cryptomining pool domains. It specifically looks for patterns like 'pool.monero', 'pool.xmr', 'pool.minexmr', 'pool.nanopool', and 'pool.supportxmr' within DNS queries, indicating potential cryptomining activity on the network.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.
This rule detects DNS queries to specific domains (connectivitycheck.gstatic.com or msftconnecttest.com) that are commonly used by operating systems and applications to check for internet connectivity. A high volume of such queries (threshold of 10 within 30 seconds from a single source) could indicate a network scan or unusual network activity.
This rule detects DNS queries for 'pastebin.com'. This activity is often associated with Command and Control (C2) communication, where attackers use services like Pastebin to host malicious code, configuration data, or receive commands. The rule triggers if 10 such queries are observed from the same source IP within a 300-second (5-minute) window, indicating potential C2 activity or data exfiltration attempts.
This rule detects a high rate of DNS queries originating from a single source IP address within a specified time frame, which can be indicative of DNS Command and Control (C2) beaconing activity. Specifically, it triggers an alert if a source IP makes 50 or more DNS queries within a 60-second window. This behavior is often associated with malware attempting to communicate with a C2 server by encoding data within DNS requests or using DNS as a covert communication channel.
COLDRIVER ROBOT chain - DNS lookup for TI delivery/C2 domains
DPRK EtherHiding (UNC5342) - DNS lookup for blockchain explorer APIs (multi-provider)
This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
Page 13 of 16