Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
581 detections
Filters
Last updated
All Time
Detection languages
189
120
83
51
41
Contributors
129
115
60
34
31
Categories
453
214
170
69
64
Platforms
298
274
70
62
13
Products / Services
137
130
103
96
79
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
1
1
1
IDS Classtypes
46
40
17
8
6
IDS Protocols
100
11
3
2
1
This rule detects suspicious DNS queries specifically targeting 'api.telegram.org'. This domain is used by Telegram Bot API, which can be leveraged by various types of malware (e.g., RATs, ransomware) for command and control (C2) or data exfiltration. Monitoring these queries helps identify systems potentially communicating with malicious Telegram bots.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS query names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beaconing activity. Specifically, it looks for DNS queries with names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
Detects suspicious DNS queries using base64 encoding
Detects strings used in command execution in DNS TXT Answer
This rule detects the ChinaZ trojan by identifying specific byte patterns associated with its functionalities. These functionalities include collecting system information, sending system information, parsing C2 commands, and performing DNS flood attacks. The rule contains distinct byte patterns for both 32-bit and 64-bit architectures of the malware.
Detects suspicious DNS queries known from Cobalt Strike beacons
Detects Silence EmpireDNSAgent as described in the Group-IP report
Well-known DNS Exfiltration tools execution
Yara rule that detects AgentRacoon backdoor.
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
Yara rule that detects TimeCrypt ransomware.
Page 28 of 28