Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
This detection identifies potentially algorithmically generated domains (DGA) observed in Trend IA XDR telemetry. DGA domains are commonly used by malware families for Command and Control (C2) communications because they generate large numbers of pseudo-random domain names, making blocking and takedown efforts more difficult.
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
Detects DNS tunnelling, where data is encoded into queries and answers against a
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
Detects a DHCP-driven DNS update for a hostname not present in the asset inventory.
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, OpenAI, and other popular providers of machine learning models and services. Monitoring these DNS requests is important because it can reveal when systems are accessing external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting such activity enables organizations to enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring provides better control over AI model usage and helps safeguard organizational data flows.
The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
This rule detects potential DNS tunneling or beaconing activity by monitoring DNS queries for patterns commonly associated with command and control traffic. It flags anomalous DNS behavior including excessively long query strings, usage of TXT or NULL record types, frequent NXDOMAIN responses, or high volumes of such queries from a single host, which are indicative of data exfiltration or C2 communication via the DNS protocol.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
The following analytic identifies DNS queries to domains associated with the 3CX supply chain attack. It leverages the Network_Resolution datamodel to detect these suspicious domain indicators. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates. If confirmed malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Page 1 of 28