Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
41
16
9
2
2
Contributors
16
12
10
7
4
Categories
33
28
22
15
14
Platforms
47
18
5
4
3
Products / Services
37
18
8
6
5
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
15
14
11
1
IDS Protocols
24
11
4
1
Detects execution of Node.js or Bun from a temporary directory performing DNS queries for public Ethereum JSON-RPC provider domains, a technique observed in supply chain compromise payloads such as Shai-Hulud and ChainDrop to resolve command and control endpoints.
Detects algorithmically generated domain names at the resolver. Malware families
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
Detects a host generating an unusual rate of failed DNS resolutions. A high NXDOMAIN
rate is the signature of a client searching for something that mostly does not exist
— DGA malware hunting for its live controller, or tooling enumerating subdomains.
This complements the DGA detection: entropy catches the shape of the names, NXDOMAIN
rate catches the behaviour regardless of how the names look.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(responsecode) like '%nxdomain%'
| duration 10m
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 50
rate is the signature of a client searching for something that mostly does not exist
— DGA malware hunting for its live controller, or tooling enumerating subdomains.
This complements the DGA detection: entropy catches the shape of the names, NXDOMAIN
rate catches the behaviour regardless of how the names look.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(responsecode) like '%nxdomain%'
| duration 10m
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 50
Detects HTTP requests and responses associated with the Wazza phishing kit, specifically targeting the /api/wazza-config endpoint and its wildcard routing configuration JSON responses.
Detects HTTP requests and responses associated with the Wazza phishing kit, specifically targeting the /api/wazza-config endpoint and its wildcard routing configuration JSON responses.
Detects HTTP requests and responses associated with the Wazza phishing kit, specifically targeting the /api/wazza-config endpoint and its wildcard routing configuration JSON responses.
Detects browser processes performing JSON-RPC network connections to known public blockchain node providers, a network behavior characteristic of the EtherHiding technique used by the ErrTraffic MaaS platform to resolve C2 infrastructure via smart contracts. This rule identifies the network-side beaconing and should be correlated with suspicious process execution chains (e.g., browser-spawned PowerShell/cmd).
Detects HTTP requests and responses associated with the Wazza phishing kit, specifically targeting the /api/wazza-config endpoint and its wildcard routing configuration JSON responses.
Detects periodic, beacon-like network activity targeting public platforms such as Steam community profiles or Telegram (api.telegram.org / t.me) originating from suspicious processes (script interpreters, unsigned binaries). This behavior is characteristic of LummaC2 and similar malware families using public web services as dead-drop resolvers for C2 fallback communication.
Detects network traffic directed towards known public DNS over HTTPS (DoH) resolvers, such as Cloudflare, Google, and Quad9. Adversaries often abuse DoH to tunnel Command and Control (C2) communication, effectively blending in with legitimate web traffic to evade traditional DNS monitoring.
Detects DNS query activity from processes commonly used as AI agent runtimes (e.g., python.exe, node.exe) toward domains characterized by DGA-like patterns, such as long alphanumeric strings or high-consonant density, which may indicate command-and-control communication.
Detects anomalous DNS activity characterized by high-frequency IP address rotation for a single domain within a 10-minute window. This behavior is indicative of fast-flux DNS techniques used by attackers to maintain C2 infrastructure and evade domain-based blocking or IP reputation filtering.
Detects Node.js processes exhibiting network activity patterns consistent with 'EtherHiding' style C2 infrastructure, characterized by multiple distinct connections to external WebSocket hosts on non-standard TCP ports within a short timeframe, potentially following interaction with a blockchain/JSON-RPC endpoint.
Detects anomalous network behavior consistent with the PolinRider malware, which uses public Ethereum JSON-RPC endpoints and blockchain explorers (e.g., Etherscan.io) as a dead-drop resolver for command-and-control (C2) communication. The rules monitor for specific RPC methods (eth_getTransactionByHash, eth_call, eth_getBalance) over HTTP/TLS and DNS resolution queries to known blockchain explorer infrastructure.
Detects network activity associated with the ErrTraffic malware, specifically targeting JSON-RPC 'eth_call' requests to Polygon blockchain smart contracts used for C2 resolution and subsequent DNS queries to known malicious domains used for C2 infrastructure.
Detects outbound HTTP POST requests to the Polygon blockchain using the 'eth_call' JSON-RPC method, specifically targeting a known smart contract address associated with EtherHiding-style C2 infrastructure. This behavior indicates an adversary utilizing decentralized blockchain storage or services as an unconventional command-and-control channel to resolve malicious configurations or payloads.
This rule detects repeated HTTP POST requests to a Polygon blockchain endpoint ('eth_call') containing specific contract address and method identifiers. This behavior is indicative of 'EtherHiding', a technique where attackers use blockchain smart contracts to host malicious C2 configurations or update C2 infrastructure, allowing for stealthy dynamic command and control rotation.
Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.
Detects network activity associated with the EtherHiding technique, where adversaries leverage the Polygon blockchain to resolve command-and-control (C2) infrastructure and communicate with malicious smart contracts. This rule identifies specific JSON-RPC requests ('eth_call') using SloppyRAT contract selectors and DNS queries for blockchain-related RPC endpoints.
Detects DNS queries for 'd.clash-verge-upgrade.com', a domain identified as a Command and Control (C2) fallback transport mechanism for the ProRAM malware.
Detects DNS queries for 'd.clash-verge-upgrade.com', a domain identified as a Command and Control (C2) fallback transport mechanism for the ProRAM malware.
Page 1 of 4