Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
ET INFO Blockchain RPC Domain in DNS Lookup (arbitrum .one)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shoplerter .opnetorologies .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
ET INFO Blockchain RPC Domain in DNS Lookup (polygon-rpc .com)
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .optimism .io)
ET INFO Blockchain RPC Domain in DNS Lookup (cloudflare-eth .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shop)
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching a pattern indicative of a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is commonly used in Kerberos coercion attacks where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, such as in CVE-2025-33073. Investigation should focus on the user account making the changes, as it is likely a compromised low-privileged account.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a '
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
KQL Query
The analytic detects instances where `vbc.exe`, the Visual Basic Command Line Compiler, initiates DNS queries. Normally, `vbc.exe` operates locally to compile Visual Basic code and does not require internet access or to perform DNS lookups. Therefore, any observed DNS activity originating from `vbc.exe` is highly suspicious and indicative of potential malicious activity. This behavior often suggests that a malicious payload is masquerading as the legitimate `vbc.exe` process to establish command-and-control (C2) communication, resolve domains for data exfiltration, or download additional stages of malware. Security teams should investigate the process's parent, command-line arguments, and the resolved domains for further indicators of compromise.
This rule identifies DNS lookups associated with common Tor proxies and services. It detects queries for domains ending in '.onion' and various Tor gateway domains (e.g., '.hiddenservice.net', '.tor2web.com', '.tor-gateways.de'). This activity can indicate the use of the Tor network for anonymization, which adversaries may leverage for command and control, data exfiltration, or to obscure their malicious activities.
Zloader Custom DNS C2
YARA-L
Detects Zloader's custom DNS tunneling protocol which uses multiple Base32 encoded subdomains for C2 communication.
This rule detects a high volume of DNS queries (over 50) from a single source IP to a limited number of destination IPs (2 or less) for non-standard domains. It excludes common legitimate domains like microsoft.com, google.com, apple.com, cloudflare.com, akamai.com, and amazonaws.com, as well as queries to private IP ranges. This pattern can indicate DNS tunneling, data exfiltration, or command and control activity.
Detects DNS queries to domains within known low reputation Effective Top-Level Domains (eTLDs). These eTLDs are often associated with malicious activities such as command and control, phishing, or malware distribution. The rule leverages a curated list of suspicious eTLDs, which is updated periodically.
Page 22 of 28