Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
2
1
1
Platforms
2
1
1
Products / Services
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query
KQL Query
Detects a DNS query to 'azurewebsites.net' originating from a process that is not a recognized web browser. Threat actors have frequently used 'azurewebsites.net' for malware hosting and data exfiltration. This rule aims to identify suspicious communication patterns where non-browser applications might be attempting to communicate with known malicious infrastructure hosted on Azure.
