Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
41
16
9
2
2
Contributors
16
12
10
7
4
Categories
33
28
22
15
14
Platforms
47
18
5
4
3
Products / Services
37
18
8
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
15
14
11
1
IDS Protocols
24
11
4
1
This rule detects DNS requests for domain names that combine Middle Eastern-themed keywords (dubai, emirates, iran, saudi, etisalat) with suspicious or cheap Top-Level Domains (TLDs) such as .top, .cyou, .click, .life, .mom, .sbs, or .xyz. This pattern can indicate potential phishing attempts, malicious infrastructure, or C2 communication attempting to blend in with legitimate traffic by using seemingly relevant but low-cost domains.
This rule detects DNS lookups to domains associated with OpenClaw, Moltbot, or Clawdbot infrastructure. It specifically looks for DNS requests containing "clawhub.ai", "openclaw.ai", "open-claw.me", "molt.bot", "openclaw.bot", "onlycrabs.ai", "moltbook.com", or "thecolony.cc". To reduce noise, it excludes DNS requests originating from known mail or DNS resolver processes such as "perl", "surgemail", "named", "smtpd", "MailService", "pdns_recursor", "unbound", "systemd-resolved", "MailEnable SMTP Connector", and "opendkim".
This rule detects HTTP traffic originating from a client within the home network to an external Cloudflare tunneling service (specifically, domains ending in '.trycloudflare.com') where the User-Agent header indicates 'Microsoft-WebDAV-MiniRedir'. This combination suggests potential command and control activity or data exfiltration using WebDAV over a Cloudflare tunnel, often employed by adversaries to bypass network restrictions and obscure their infrastructure.
ET INFO DYNAMIC_DNS Query to a *.3trust .com domain
ET INFO DYNAMIC_DNS Query to a *.freeddns .me domain
ET INFO DYNAMIC_DNS Query to a *.anchorchain .co .za domain
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain
ET INFO DYNAMIC_DNS HTTP Request to a *.hornburst .com domain
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.3trust .com domain
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (vercel .app in TLS SNI)
ET INFO DYNAMIC_DNS Query to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain
This rule detects DNS queries to known malicious domains by joining IdentityQueryEvents with ThreatIntelligenceIndicator data. It specifically looks for matches between the queried domain (QueryTarget) and known malicious domains (DomainName) from threat intelligence feeds.
Detects DNS queries for domains known to be used by the DarkCloud campaign for payload delivery and C2 communication. This rule specifically targets domains used for initial payload download, final payload delivery, and public IP address determination.
Detects network connections using DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) to known public resolvers from non-browser processes. This activity can indicate an attempt to bypass network security controls and monitoring by hiding DNS queries within encrypted traffic.
Page 3 of 4