Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
This rule detects network connections to known dynamic DNS (DDNS) subdomains. Adversaries often use dynamic DNS services to maintain persistent command and control (C2) communication channels, as these services allow them to frequently change the IP address associated with a static hostname, making it harder for defenders to block or track their infrastructure. These providers also have established domain reputation, and provide legitimate services making blanket IOC rules impossible. The rule identifies connections to specific DDNS providers such as DuckDNS, No-IP, PublicVM, and others.
Looking for several activities that are documented as being part of the initial infection chain for NotDoor (https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/).
Nice as a quick historical check for any potentially interesting things to investigate further.
Nice as a quick historical check for any potentially interesting things to investigate further.
The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, a popular provider of machine learning models and services. Monitoring for such DNS requests is important because it can reveal when systems are reaching out to external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting these queries helps organizations enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring ensures better control over AI model usage and organizational data flows.
Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.
The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
This rule detects an unusually high volume of DNS queries originating from a single device within a one-hour window. This behavior can be indicative of various malicious activities such as DNS tunneling for command and control, data exfiltration, or extensive reconnaissance.
Hunts for abuse of Microsoft 365’s Direct Send feature where attackers send spoofed emails appearing internal, bypassing filters. Includes detection of suspicious DNS queries, outbound network connections, and PowerShell abuse for insider misuse.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
This hunting query detects potential abuse of the MS-RPC protocol for DoS/DDoS attacks by monitoring outbound LDAP-related DNS queries originating from Domain Controllers.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. Devtunnels can be used for command and control or data exfiltration by tunneling traffic over legitimate-looking DNS requests.
Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects the NoDepDNS backdoor, a Golang-based implant used by the CL-STA-0969 threat actor. It passively listens on UDP port 53 for DNS queries and executes XOR-encoded commands embedded in the IP address responses.
Detects DNS queries to a command and control (C2) domain used by the AK47C2 backdoor, which is part of the Project AK47 toolset associated with the CL-CRI-1040 (Storm-2603) threat actor.
Identifies DNS queries to non-standard ports, often used for DNS tunneling or C2. **Validation**: High - DNS to non-53 ports is rarely legitimate.
Detects network connections using DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) to known public resolvers from non-browser processes. This activity can indicate an attempt to bypass network security controls and monitoring by hiding DNS queries within encrypted traffic.
Detects TTPs associated with the HazyBeacon backdoor, which has been observed targeting governmental entities in Southeast Asia. This rule identifies specific service creation for persistence, DLL sideloading of mscorsvc.dll, C2 communication via AWS Lambda URLs, and execution of known exfiltration tools from the C:\ProgramData directory.
KQL Query from file: Direct Send Abuse Detection
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: Detecting Blind Eagle APT-C-36
Page 23 of 28