Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects potential DNS tunneling or Command and Control (C2) activity by analyzing DNS query patterns. The rule identifies anomalous behavior based on high query volume, excessive unique subdomain fanout to a single parent domain, and unusually long average query lengths. This combination is often indicative of data exfiltration or communication with a C2 server over the DNS protocol.
Detects potential DNS tunneling or command-and-control (C2) traffic by identifying abnormally long DNS query names, which often indicate encoded data channels, and suspicious usage of TXT or NULL DNS records, which are frequently used by tools like Cobalt Strike, dnscat2, and iodine for C2 communication.
Detects DNS queries originating from NetScaler appliances that exhibit algorithmically generated domain (DGA) characteristics or utilize top-level domains (TLDs) frequently associated with malicious command and control infrastructure. This rule aims to identify potential post-exploitation C2 communication following a compromise of a NetScaler ADC or Gateway appliance.
Detects network traffic directed towards known public DNS over HTTPS (DoH) resolvers, such as Cloudflare, Google, and Quad9. Adversaries often abuse DoH to tunnel Command and Control (C2) communication, effectively blending in with legitimate web traffic to evade traditional DNS monitoring.
Detects anomalous network behavior where a source host initiates a high volume of DNS TXT record queries to an external domain within a short timeframe. Such patterns are indicative of data exfiltration or C2 communication tunneling through DNS protocol.
This rule detects potential DNS tunneling or DNS-based command and control (C2) beaconing. It analyzes DNS query logs for characteristics typical of C2 traffic, such as high subdomain entropy, frequent use of TXT or NULL records, and a high volume of unique subdomains originating from a single source IP address within a 5-minute window.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects DNS queries for domains associated with DPRK-aligned threat actor backdoors, specifically identified in research as related to curlRAT or similar secondary-stage malware communication. Monitoring these domains can identify potential beaconing or C2 communication from compromised hosts.
This rule correlates multiple telemetry sources (File Events, Certificate Info, Network Events, and DNS Events) to detect known malicious indicators, including specific file hashes, IP addresses, domains, and URLs associated with malicious activity.
Detects anomalous DNS traffic patterns characterized by a high volume of unique subdomains, frequent long DNS query labels, or excessive use of TXT/NULL record types. These behaviors are frequently associated with DNS tunneling, a method used by adversaries to exfiltrate data or communicate with Command and Control (C2) servers via the DNS protocol.
Detects DNS tunneling attempts by identifying DNS queries with abnormally long subdomains (greater than 50 characters) that exhibit a high request rate (20 or more queries within 60 seconds). This behavior is characteristic of C2 communication tools such as iodine or dnscat2, which encode data within DNS query labels to bypass traditional network security controls.
This rule detects potential DNS tunneling activities used for data exfiltration. It identifies suspicious patterns by monitoring for a sustained, high volume (over 200) of DNS queries containing long, high-entropy encoded strings within the subdomain segment from a single client IP address. Legitimate traffic such as reverse DNS lookups is excluded to minimize noise.
This rule detects potential DNS tunneling or beaconing activity by monitoring DNS queries for patterns commonly associated with command and control traffic. It flags anomalous DNS behavior including excessively long query strings, usage of TXT or NULL record types, frequent NXDOMAIN responses, or high volumes of such queries from a single host, which are indicative of data exfiltration or C2 communication via the DNS protocol.
Detects high-entropy or unusually long encoded subdomain labels in DNS queries, which are characteristic of DNS tunneling tools like iodine, dnscat2, and dns2tcp used for command and control (C2) communication or data exfiltration over the DNS protocol.
This rule detects potential DNS tunneling activity by analyzing DNS query logs for high entropy in subdomains, elevated volumes of TXT/NULL record types, and frequent NXDOMAIN responses. This pattern is characteristic of command-and-control (C2) or data exfiltration techniques using tools like dnscat2 or iodine, which encode data into DNS query labels.
This rule detects potential DNS tunneling activities often associated with Command and Control (C2) communication. It monitors for anomalous patterns including excessively long DNS query labels, the use of uncommon DNS record types (TXT or NULL), and high volumes of DNS traffic directed towards specific domains. These behaviors are common indicators of data exfiltration or covert beaconing attempts designed to bypass traditional network security controls.
Detects a ClickFix-style activity where an adversary uses nslookup.exe or certutil.exe to perform DNS TXT record queries for payload staging or C2 rendezvous. The rule identifies suspicious parent processes like explorer.exe or scripting hosts, correlates this with a subsequent outbound network connection from the same host, and is intended to capture DNS-based beaconing or data staging.
Detects high-volume DNS traffic characterized by long, high-entropy subdomain labels, which are often used as a mechanism for command-and-control (C2) communication or data exfiltration via DNS tunneling.
Page 2 of 28