Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
2
2
1
Categories
4
3
3
2
2
Platforms
4
2
2
2
Products / Services
3
2
1
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
Detects anomalous outbound proxy requests to TON blockchain API endpoints (tonapi.io or toncenter.com) attempting to call the 'get_domain' method. This behavior is associated with the TONResolver RAT, which uses a specific, hardcoded smart contract address to dynamically resolve its C2 server hostname, effectively bypassing static domain-based security filters.
Detects the TONResolver RAT attempting to resolve its Command and Control (C2) server address by querying TON blockchain API endpoints. The rule monitors network connections and DNS queries made by non-standard processes to known TON API infrastructure, specifically tracking potential dead-drop resolver behavior where smart contract data is used to obtain malicious infrastructure addresses.
This rule detects DNS queries for TXT records that contain specific patterns indicative of DNS calculation C2 (Command and Control) activity. The pattern searched for is a PCRE regex matching two alphanumeric strings, each 4 to 8 characters long, separated by a dot (e.g., 'abcd.efgh.'). This type of activity is often associated with malware using DNS TXT records to encode C2 instructions or data, potentially involving IP math for dynamic C2 server resolution. The rule includes a threshold to prevent excessive alerts, triggering if 5 such queries are observed from the same source within 60 seconds.
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search