Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
1
1
1
1
Platforms
2
1
1
Products / Services
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects DNS queries that contain unusually long, seemingly random strings (50 or more alphanumeric characters) in the query name. This pattern is often used by malware for Command and Control (C2) communication, where the long string serves as 'junk data padding' to obfuscate the actual C2 data or to make detection more difficult. The rule specifically looks for DNS queries (port 53) and applies a threshold to prevent excessive alerts from a single source, triggering if 5 such queries are observed within 30 seconds from the same source IP.
This rule detects HTTP POST requests from the home network to any destination that contain a large amount of junk data padding in the client body. Specifically, it looks for a client body size greater than 1000 bytes and a PCRE match for at least 500 alphanumeric characters, indicating potential command and control (C2) communication using data padding for obfuscation or to bypass detection. A threshold is set to trigger an alert if 10 such requests are observed from the same source within 60 seconds.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
