Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
4
3
1
1
Contributors
4
3
1
1
Categories
8
7
2
2
1
Platforms
7
2
Products / Services
3
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
IDS Protocols
2
1
This rule detects potential Bluekit PhaaS C2 infrastructure by identifying fast-flux DNS behavior. It monitors DNS queries for domains associated with Bluekit phishing campaigns and flags instances where a single hostname resolves to a high number of distinct IP addresses (3 or more) within a one-hour window, which is indicative of domain rotation for evasion.
This rule monitors network logs for potential malicious activity by analyzing subdomain cardinality and identifying known phishing domains. It flags apex domains that exhibit high subdomain rotation (5 or more distinct subdomains within an hour), indicative of fast-flux DNS techniques, or that match a static list of known malicious/phishing infrastructure.
Detects potential fast-flux DNS behavior indicative of Bluekit PhaaS P2P infrastructure. The rule monitors for browser processes resolving a single domain to 5 or more distinct external IP addresses within a one-hour window, excluding known CDNs and cloud infrastructure.
Detects fast flux DNS used to rapidly change C2 IP addresses
This rule detects DNS responses with a very low Time-To-Live (TTL) value, which is a characteristic often associated with fast flux techniques used by malware to rapidly change IP addresses. Specifically, it looks for UDP traffic on port 53 (DNS) where the DNS response contains a specific content pattern indicating a low TTL.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
Detects fast flux DNS used to rapidly rotate C2 infrastructure IPs
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (sessionstorexint .com)
KQL Query
