Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
5
3
2
1
1
Contributors
2
2
2
1
1
Categories
5
4
3
2
2
Platforms
7
3
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
AWS Route 53 DNS Record Modification
Cortex XDR
Detects modifications to AWS Route 53 DNS resource record sets. Monitoring these changes is critical for identifying potential DNS hijacking, traffic redirection, or unauthorized infrastructure configuration changes within the AWS environment.
This rule detects potential DNS hijacking or redirection by comparing the returned IP address from a DNS query against a known list of authoritative IP addresses for specific domains. If an internal DNS resolver returns an IP address that does not match the authoritative record, it flags the event as a potential DNS response mismatch. It includes risk scoring based on the number of distinct affected hosts.
This rule detects potential DNS hijacking or redirection by comparing the returned IP address from a DNS query against a known list of authoritative IP addresses for specific domains. If an internal DNS resolver returns an IP address that does not match the authoritative record, it flags the event as a potential DNS response mismatch. It includes risk scoring based on the number of distinct affected hosts.
This rule detects the creation of Azure DNS zones by callers who have no prior history of writing to DNS zones within a specified lookback period. This behavior can indicate an attempt at DNS zone takeover, as observed in campaigns like 'Borrowed Trust' or 'link99', where adversaries might create orphaned DNS zones to redirect traffic or host malicious content.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
_ldap._tcp.dc._msdcs.ad.domain.com is a DNS query used by AD clients to locate Domain Controllers that can provide LDAP services for the ad.domain.com domain, ensuring users and computers can authenticate, query directory data, and function inside the AD forest.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
KQL Query from file: LDAPNightmare POC Detection
KQL Query
detects a possible IPv6 DNS takeover using ISATAP configuration events (Event ID 4100) new ISATAP router was set successfully
Device Network Events Involving Low Count FQDNs.
This query reduces network events to only those with the RemoteURL column populated,.
Then parses the DNS name from the URL (if needed) and finds the least prevalent.
FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous.
Network communication.
This query reduces network events to only those with the RemoteURL column populated,.
Then parses the DNS name from the URL (if needed) and finds the least prevalent.
FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous.
Network communication.
'This query identifies matches based on domain IOCs related to KNOTWEED against Microsoft Defender for Endpoint device network connections'