Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
15
5
2
1
Contributors
7
4
3
2
2
Categories
10
9
8
7
3
Platforms
16
4
1
1
1
Products / Services
15
11
4
2
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
7
5
3
IDS Protocols
11
2
2
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
This rule detects network connections (TLS SNI and HTTP requests) to domains associated with the AnonyMousKIT PhaaS (Phishing-as-a-Service) platform. It flags connections to known phishing backend domains and monitors for access to suspicious management dashboard paths commonly utilized by this threat actor for managing phishing orders and communications.
Detects DNS queries to known malicious subdomains and direct TCP connections to an IP address associated with the SilkParasite, NodeEdgeRAT, and NomadRAT malware infrastructure. The rule specifically monitors for communication with identified C2 infrastructure hosts and legacy domain registration points.
This rule detects DNS queries for domains that are categorized as Newly Registered Domains (NRD) or Newly Observed Domains (NOD) and are using specific Cloudflare nameserver pairs (randy.ns.cloudflare.com and stevie.ns.cloudflare.com). These specific nameservers have been identified as part of the infrastructure used by the Exvicy malware distribution framework to manage its disposable, short-lived domain portfolio.
Detects network communication associated with the SilkParasite campaign, specifically identifying TLS traffic using fraudulent certificates impersonating the Uzbekistan railway authority (azure.uzrailwaystax.com) and connections to identified malicious infrastructure using specific JA4X TLS fingerprinting.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Identifies DNS queries to a known malicious C2 domain and summarizes activity by client IP, including the first and last observed query and total query count.
This rule detects the addition of TXT or CNAME records within Azure-managed DNS zones that correspond to third-party email sending platforms, specifically Amazon SES or Resend. It monitors for the creation of DKIM selectors or SPF records that authorize these services to send emails on behalf of the organization's domain, which can be used to facilitate email spoofing or phishing.
Detects a DNS query for diagrtrack.com, a typosquat of Windows DiagTrack registered to serve as this backdoor's C2 infrastructure (dormant since early 2021).
Detects inbound email messages authenticated with an amazonses.com DKIM signature that originate from a specific Amazon SES Tokyo-region relay IP address. This may indicate an adversary is leveraging a compromised or unauthorized transactional email account (e.g., SES or third-party platforms like Resend) to send emails on behalf of a victim domain.
Detects HTTP requests for fingerprinted JavaScript/CSS assets shared across UNC6671's cloned SSO and cryptocurrency vault-drainer phishing panels.
Detects DNS queries to the broader set of UNC6671/Blackfile/Pink/Falcon passkey- and SSO-themed lookalike phishing domains used across the campaign's rebrand clusters.
This rule detects HTTP traffic where the host header contains a domain with at least 8 alphanumeric characters followed by a common top-level domain (.com, .net, .org), and the URI contains the string 'gate' (case-insensitive). This pattern is indicative of a hijacked legitimate domain being used for Command and Control (C2) communication.
This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.
Detects when a transfer lock was removed from an AWS Route 53 domain. This action is typically performed when intending to transfer the domain to a different registrar, but it can also be an indicator of malicious activity if unauthorized. Disabling the transfer lock makes the domain vulnerable to unauthorized transfers, which could lead to domain hijacking or redirection of traffic.
Detects network connections using DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) to known public resolvers from non-browser processes. This activity can indicate an attempt to bypass network security controls and monitoring by hiding DNS queries within encrypted traffic.
Page 1 of 2