Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.
Detects DNS query bursts from a single source to a predefined set of domains mimicking passkey or single-sign-on (SSO) login portals. These domains are known to be part of the infrastructure used by the UNC6671 threat actor for credential harvesting activities.
UNC6671 AiTM passkey/SSO lookalike domain DNS query
Detects DNS queries for Storm-2945 Microsoft-impersonating doppelganger domains and traffic to actor-controlled AitM resolver/redirect infrastructure on captive-portal networks.
Detects a high-volume DNS TXT-record query flood (200+ queries in 5 minutes) to a single destination, excluding common legitimate high-volume TXT consumers (SPF/DKIM/DMARC validators), indicative of DNS tunneling.
ChainDrop Mini Shai-Hulud npm supply-chain worm C2 infrastructure DNS lookup
Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.
Detects successful DNS resolution responses, TLS SNI values, and HTTP Host headers referencing known Shai-Hulud/Miasma token-jacking transfer station infrastructure (amutes.com, abb1.life) used by attackers to resell stolen AI/LLM API access via gray-market proxy services.
Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Dolphin X DNS query for thedolphinx.top C2 domain
STAC4749 sc5.exe reverse SOCKS proxy C2 domain query (legio.name)
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
This rule monitors DNS queries for the domain 'veyko-service.org', which is identified as being associated with the NodeSnake RAT (Remote Access Trojan). The detection indicates potential command-and-control (C2) activity where an infected host attempts to reach a malicious infrastructure domain.
Detects DNS queries matching known malicious infrastructure domains identified in SourTrade malvertising campaigns. These domains are often used by threat actors to host malicious payloads or C2 infrastructure.
This rule detects DNS queries for the domain 'xoredo-srv.com', which is associated with the INTERLOCK NodeSnake RAT for command and control communications.
Detects DNS queries matching the pattern used by the CAV3RN C2 infrastructure. The rule identifies specific subdomains under 'cloudlanecdn.com' that follow a structured format consistent with C2 configuration recovery and heartbeat beacons, specifically looking for a hex-encoded timestamp pattern.
Detects a specific DNS AAAA record response containing a hardcoded sentinel value (2001:4998:44:3507::8000) associated with the CAV3RN framework, which signals a failed configuration recovery process.
This rule detects DNS queries for the domain 'terezo-kb.org', which is associated with the NodeSnake Remote Access Trojan (RAT), often utilized by the INTERLOCK ransomware group for command and control (C2) communication.
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
Page 9 of 16