Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
107 detections
Filters
Last updated
All Time
Detection languages
43
29
15
8
4
Contributors
24
23
9
8
6
Categories
54
47
47
34
21
Platforms
54
47
11
11
4
Products / Services
30
30
26
15
9
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
IDS Classtypes
18
10
IDS Protocols
10
9
9
Detects high-frequency DNS queries for long, random-looking subdomains that result in NXDomain responses, a behavioral indicator of malware using Domain Generation Algorithms (DGA) for command-and-control beaconing.
Detects DNS queries for 14-character alphanumeric .org domains characteristic of Bumblebee malware's Domain Generation Algorithm (DGA).
Detects a web process modifying a .php file within WooCommerce paths, immediately followed by a DNS resolution for the 'generate.2faplugin.org' domain. This activity is indicative of the ShapedPlugin supply chain compromise where backdoored plugins are distributed, leading to file modification and subsequent communication with a malicious 2FA plugin domain.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule detects DNS queries for domains that exhibit characteristics of Domain Generation Algorithms (DGAs). Specifically, it looks for DNS queries where the queried domain consists of a random-looking subdomain (12 to 24 lowercase alphanumeric characters) followed by common top-level domains such as .com, .net, .org, .info, or .biz. The rule uses a thresholding mechanism to trigger an alert if 10 such queries are observed from the same source IP within a 60-second window, indicating potential DGA activity often associated with botnets or malware for command and control.
Detects DNS lookups targeting the .xyz TLD indicative of Potemkin DGA behavior, specifically when initiated by 'RunSearch.exe'. The regex identifies domain names with a pattern of 2 or 3 hyphen-separated alphanumeric strings, followed by the .xyz TLD.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.
Detects DNS requests to a known BNB Smart Chain Testnet JSON-RPC endpoint used by AnimateClipper to dynamically resolve its actual C2 domain via a smart contract.
Detects DNS requests to a known BNB Smart Chain Testnet JSON-RPC endpoint used by AnimateClipper to dynamically resolve its actual C2 domain via a smart contract.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Flags Sysmon DNS query events (EID 22) for several weak DGA / DNS-tunnel style heuristics: very long first label, many dot-separated labels, a long alphanumeric prefix (encoded-chunk style), or a suffix on budget/phishing-heavy gTLDs and alternate naming TLDs. Noisy by design — align thresholds with Suricata custom rules in suricata/custom/detecton-lab-dns-dga-hints.rules. Does not replace resolver analytics, ET DNS rules, or ML DGA classifiers.
This rule detects the multi-stage installation and command-and-control (C2) activities associated with GhostClaw or GhostLoader malware on macOS systems. It correlates suspicious process executions, such as curl-based bootstrap, install.sh execution, user-space Node.js setup, and outbound network traffic to 'trackpipe.dev' with UUID-like pathing or specific NODE_CHANNEL values. The rule looks for a combination of at least three of these indicators within a two-hour window to reduce false positives.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects DNS queries for domains matching the pattern used by the PLASMAGRID implant's Domain Generation Algorithm (DGA). The implant, associated with the Coruna exploit kit, generates 15-character domains with a .xyz TLD as a C2 fallback mechanism.
Detects DNS queries for domains that match the pattern used by the PLASMAGRID malware's Domain Generation Algorithm (DGA). This malware, delivered by the Coruna iOS exploit kit, uses a DGA seeded with "lazarus" to generate 15-character domains with a ".xyz" TLD for command and control fallback.
Detects non-browser processes making DNS-over-HTTPS (DoH) queries to Cloudflare's DNS service. This specific behavior is used by the Dohdoor backdoor to resolve its C2 domains while evading traditional DNS monitoring. The rule specifically looks for connections to Cloudflare's DoH service (1.1.1.1 or cloudflare-dns.com on port 443 with the /dns-query path) from processes that are not common web browsers. The fidelity is significantly increased by the optional check for the 'insomnia' User-Agent, which is characteristic of the Dohdoor malware.
This rule detects suspicious DNS queries made by common Windows command-line interpreters and scripting engines. It specifically looks for `nslookup.exe` or `dig.exe` being spawned by `cmd.exe`, `powershell.exe`, `pwsh.exe`, `explorer.exe`, `wscript.exe`, `cscript.exe`, or `mshta.exe`. The detection is further refined by looking for specific DNS query types (TXT, MX, SRV, AAAA), service records (`._tcp.`, `._udp.`), or `.onion` domains in the command line. Additionally, it requires corroboration through the presence of an IP address or `-server=` in the command line, or specific PowerShell/command-line obfuscation/execution techniques, or suspicious top-level domains (TLDs) like `.xyz`, `.top`, `.tk`, `.ru`, `.cn`, `.cc`, `.ws`, `.pw`, `.onion`, `.direct`, `.surf`. The rule explicitly excludes queries to `localhost` or common legitimate DNS records like `_dmarc.`, `_dkim.`, `_spf.`, `_acme-challenge.`, `_domainkey.`, `_msdcs.` to reduce false positives.
Detects network connections to domains and IPs associated with the Notepad++ supply chain attack. These indicators are linked to the distribution of Cobalt Strike and the Chrysalis backdoor.
Page 4 of 6