Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.
Detects network activity (DNS, TLS SNI, and HTTP Host) associated with the SynkLoader malware's command-and-control infrastructure using the domain 'dondermicapp.net'.
Detects DNS queries for domains identified as part of the GoCaracal campaign, associated with the threat actor Dark Caracal. These domains are known to be used for the delivery and staging of SVG-based phishing attacks.
Detects DNS queries to Cloudflare Workers subdomains that mimic the QUICAgent beaconing pattern. Adversaries utilize these workers as dead-drop resolvers to retrieve updated C2 instructions or redirection information, effectively blending in with legitimate traffic to the workers.dev domain.
Detects potential DGA fallback beaconing: repeated lookups (~10 per 5 days) of algorithmically-generated .com domains with a failed-resolution cadence, matching the botking implant's C2 fallback behavior.
Detects DNS queries containing high-entropy domain labels that exhibit patterns common to Domain Generation Algorithms (DGA). The rule triggers when a threshold of such suspicious queries is exceeded from a single source within a 60-second window, which is a common indicator of malware beaconing or C2 communication.
Detects a malformed/high-entropy repeated-label DNS query pattern used by ACRStealer as a connectivity canary check prior to establishing C2.
Detects DNS queries for suspicious subdomains on known Mirage2FA phishing kit domains ('cheacker.store' and 'volatilesour.store'). The rule identifies queries where the subdomain is Base64-encoded and decodes into an email-like format, which is a technique used by this phishing kit to track or validate victim-specific session tokens or email addresses.
Detects DNS resolution and subsequent TLS connection to the ACRStealer Telegram-based Dead Drop Resolver domain (res.explicittweak.cc), used to fetch C2 configuration via Telegram's IP range.
Detects a DNS query for diagrtrack.com, a typosquat of Windows DiagTrack registered to serve as this backdoor's C2 infrastructure (dormant since early 2021).
Detects DNS, HTTP, and TLS access to the public code-hosting repositories publishing the ShieldBreak Microsoft Defender 0-day exploit (GitHub, git.projectnightcrawler.dev, git.churchofmalware.org).
Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.
Detects XG-Web implant check-in beacons — DNS lookups and HTTP config_*.js fetches — against Jewelbug's typosquatted C2 domain set, the unified panel reported to have logged over one million implant check-ins.
Detects a DNS query with a high-entropy label repeated identically as both subdomain and domain (e.g. X.X), used by ACRStealer as a connectivity/canary check prior to establishing C2.
Detects encapsulated C2 traffic over non-standard ports and DNS/HTTP tunneling patterns using entropy/volume thresholds and sustained-pattern requirements to avoid matching ordinary long DNS queries, excluding known legitimate tunneling tools/VPN endpoints.
ClickFix staging domain DNS query - profitnow.io
Detects DNS, TLS SNI, and HTTP Host traffic to the known ClickFix delivery domain karburatorotzhigi[.]com or the exact Cloudflare R2 hosting bucket subdomain pub-b7e3d7ad9f6e4b08a24cde45feeb417e.r2[.]dev used in UNC5142 campaign infrastructure.
Detects DNS queries and HTTP traffic to Jewelbug's known typosquatted C2 domains (fonts.chrorne[.]com, fonts.tarotfree101[.]top, robot.avbliud[.]com, www.f1ash[.]org[.]cn) via exact-match logic to avoid fuzzy-matching false positives.
Detects ClientKing's custom DNS-tunneling C2 channel via high-entropy, long subdomains in TXT-record queries at sustained volume.
Detects DNS queries to the broader set of UNC6671/Blackfile/Pink/Falcon passkey- and SSO-themed lookalike phishing domains used across the campaign's rebrand clusters.
ChainDrop Mini Shai-Hulud npm supply-chain worm C2 infrastructure DNS lookup
Page 8 of 16