Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
107 detections
Filters
Last updated
All Time
Detection languages
43
29
15
8
4
Contributors
24
23
9
8
6
Categories
54
47
47
34
21
Platforms
54
47
11
11
4
Products / Services
30
30
26
15
9
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
IDS Classtypes
18
10
IDS Protocols
10
9
9
This detection identifies potentially algorithmically generated domains (DGA) observed in Trend IA XDR telemetry. DGA domains are commonly used by malware families for Command and Control (C2) communications because they generate large numbers of pseudo-random domain names, making blocking and takedown efforts more difficult.
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
Detects algorithmically generated domain names at the resolver. Malware families
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
Detects network connections over port 443 to domains that have not been observed in the environment during the preceding 30-day window, specifically targeting domains with character-diversity patterns indicative of algorithmic generation rather than standard human-readable naming conventions.
Detects DNS queries originating from NetScaler appliances that exhibit algorithmically generated domain (DGA) characteristics or utilize top-level domains (TLDs) frequently associated with malicious command and control infrastructure. This rule aims to identify potential post-exploitation C2 communication following a compromise of a NetScaler ADC or Gateway appliance.
This rule detects DNS queries for domains associated with DPRK-aligned threat actor backdoors, specifically identified in research as related to curlRAT or similar secondary-stage malware communication. Monitoring these domains can identify potential beaconing or C2 communication from compromised hosts.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects anomalous DNS traffic patterns indicative of malware Domain Generation Algorithms (DGA). The rule identifies multiple NXDOMAIN responses for domains exhibiting high-entropy character structures (high consonant-to-vowel ratios, random alphanumeric string patterns) originating from a single source IP within a short timeframe, which is a common indicator of C2 beaconing attempts.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
Detects high-frequency DNS NXDOMAIN responses for domains exhibiting patterns indicative of Domain Generation Algorithms (DGA), specifically fixed-length, high-entropy character strings. This behavior is commonly associated with botnets attempting to locate command and control infrastructure.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
Detects DNS queries for randomized subdomains (8-12 character alphanumeric labels) prepended to specific thematic .de parent domains. This pattern is characteristic of phishing infrastructure rotation and device-code phishing campaigns where adversaries dynamically generate domains to evade detection.
Detects DNS queries for randomized subdomains (8-12 character alphanumeric labels) prepended to specific thematic .de parent domains. This pattern is characteristic of phishing infrastructure rotation and device-code phishing campaigns where adversaries dynamically generate domains to evade detection.
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
Page 1 of 6