Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
4
3
3
2
Contributors
3
3
2
1
1
Categories
8
6
5
1
1
Platforms
8
4
1
1
Products / Services
3
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Flags Sysmon DNS query events (EID 22) for several weak DGA / DNS-tunnel style heuristics: very long first label, many dot-separated labels, a long alphanumeric prefix (encoded-chunk style), or a suffix on budget/phishing-heavy gTLDs and alternate naming TLDs. Noisy by design — align thresholds with Suricata custom rules in suricata/custom/detecton-lab-dns-dga-hints.rules. Does not replace resolver analytics, ET DNS rules, or ML DGA classifiers.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Detects indicators of compromise (IOCs) associated with the GOLD BLADE threat group's July 2025 campaign, including file hashes and C2 domains.
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
This rule detects attempts to access domains that have been registered within the last 30 days. It correlates network HTTP or generic network connection events with WHOIS data to identify recently created domains. The rule leverages WHOIS enrichment to determine the creation time of the accessed domain and flags any access to domains created within the specified 30-day window.
This rule detects when a network connection is made to a domain that has expired. It leverages WHOIS data to identify domains whose expiration time is before the event timestamp. The rule specifically looks for HTTP network events and joins them with WHOIS information to identify access to recently expired domains. This could indicate access to potentially malicious infrastructure, as expired domains can be re-registered by threat actors for nefarious purposes.
This rule detects DNS queries to domains that have been created within the last 30 days. This behavior can be indicative of newly registered malicious domains used for command and control, phishing, or other adversarial activities. The rule correlates DNS query events with WHOIS data to identify the domain creation time.
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
