Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
ET INFO DYNAMIC_DNS Query to a *.3trust .com domain
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .infura .io)
ET INFO DYNAMIC_DNS Query to a *.freeddns .me domain
ET INFO DYNAMIC_DNS Query to a *.anchorchain .co .za domain
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (forrbes .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (varorg .com)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (2b2tlLVJlc3RNZX) in DNS TXT Reponse
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (cronapiworkersvc .com)
ET INFO VNT VPN Domain in DNS Lookup (vnt .wherewego .top)
ET INFO VNT VPN Domain in DNS Lookup (vnt .8443 .eu .org)
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (dotauan .pro)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (leHQuRW5jb2) in DNS TXT Reponse
ET MALWARE Observed DNS Query to Malicious Domain (significant-adopted-bearing-own .trycloudflare .com)
ET INFO Blockchain RPC Domain in DNS Lookup (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in DNS Lookup (arbitrum .one)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shoplerter .opnetorologies .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
ET INFO Blockchain RPC Domain in DNS Lookup (polygon-rpc .com)
Page 15 of 16