Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source and domain. The model generates a probability score (pred_is_exfiltration_proba) indicating the likelihood of data exfiltration. This activity is significant as DNS tunneling can be used by attackers to covertly exfiltrate sensitive data. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising the organization's security posture.
The analytic identifies excessive DNS query failures by counting DNS responses that do not indicate success, triggering when there are more than 50 occurrences. It leverages the Network_Resolution data model, focusing on DNS reply codes that signify errors. This activity is significant because a high number of DNS failures can indicate potential network misconfigurations, DNS poisoning attempts, or malware communication issues. If confirmed malicious, this activity could lead to disrupted network services, hindered communication, or data exfiltration attempts by attackers.
This analytic identifies suspicious DNS TXT records using a pre-trained deep learning model. It leverages DNS response data from the Network Resolution data model, categorizing TXT records into known types via regular expressions. Records that do not match known patterns are flagged as suspicious. This activity is significant as DNS TXT records can be used for data exfiltration or command-and-control communication. If confirmed malicious, attackers could use these records to covertly transfer data or receive instructions, posing a severe threat to network security.
This analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It monitors process executions, specifically focusing on nslookup.exe, and identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious, this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses.
This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. This activity is significant because attackers may attempt to recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
The following analytic identifies DNS requests with unusually large query lengths for the record type being requested. It leverages the Network_Resolution data model and applies a machine learning model to detect outliers in DNS query lengths. This activity is significant because unusually large DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to exfiltrate sensitive data or maintain persistent communication channels with compromised systems.
This analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.
This analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding twice the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.
This analytic detects suspicious `rundll32.exe` processes making DNS queries. This behavior is often associated with malware like IcedID, which uses `rundll32.exe` to check internet connectivity and communicate with command and control (C2) servers for configuration and payload downloads. Successful exploitation could lead to persistence, additional payload delivery, and data exfiltration.
This rule detects the use of PowerShell in conjunction with nslookup to create a download cradle. This technique leverages nslookup to extract payloads from DNS TXT records, which are then processed by PowerShell. This is a known method for adversaries to download malicious content while potentially evading traditional network defenses by using DNS for data transfer.
This rule detects DNS queries to domains that have been created within the last 30 days. This behavior can be indicative of newly registered malicious domains used for command and control, phishing, or other adversarial activities. The rule correlates DNS query events with WHOIS data to identify the domain creation time.
This rule detects DNS queries for domains that contain a specific string (e.g., a company name) and are not registered with an approved domain registrar. It leverages WHOIS data to identify potentially malicious typosquatting domains that have been recently registered or observed. The rule specifically looks for DNS queries where the domain name matches a defined pattern (e.g., 'threatpunter') and the WHOIS information indicates a registrar other than the approved one ('MarkMonitor Inc.'). Additionally, it checks if the domain was first seen in the environment within the last 30 days, indicating a new or suspicious registration.
This rule detects DNS queries for domains that have a very low rolling maximum prevalence (3 or less over a 10-day period). This can indicate newly registered domains, domains used for command and control, or other suspicious activity that has not yet gained widespread legitimate use. The rule correlates DNS events with derived prevalence data to identify these low-prevalence domains.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
DNS query to a recently created domain
Detects DNS queries for specific command and control (C2) domains known to be used by DPRK (Democratic People's Republic of Korea) threat actors. The rule specifically looks for 'connection.lockscreen.kro.kr' and 'updating.dothome.co.kr' in DNS query names.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS queries starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS command and control (C2) communication.
This rule detects suspicious DNS queries where the Z flag bit in the DNS protocol header is set to a non-zero value. The Z flag is reserved (unused) per IETF design, though it has recently been used in DNSSec. A non-zero Z flag value should be rare outside of legitimate DNSSec usage. The rule includes exclusions for common TLDs, query types (NS, MX), responses, and NetBIOS related traffic to reduce false positives. The rule's intent is to identify potential command and control (C2) or data exfiltration attempts leveraging DNS anomalies.
This rule detects the execution of well-known DNS exfiltration and tunneling tools, specifically 'iodine.exe' and 'dnscat2'. These tools are commonly used by adversaries to establish covert communication channels over DNS, allowing for data exfiltration and command and control activities that might bypass traditional network defenses.
Detects DNS TXT records containing strings commonly used for command execution, such as 'IEX' (Invoke-Expression), 'Invoke-Expression', and 'cmd.exe'. This technique can be used by adversaries for command and control (C2) or data exfiltration by embedding commands within DNS responses.
Detects suspicious DNS queries that contain a base64 encoded string, indicated by the '==.' pattern. This pattern is often used in DNS exfiltration techniques where data is encoded in base64 and sent via DNS queries to bypass network defenses.
Page 27 of 28