Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
4
3
2
Contributors
3
2
1
1
1
Categories
3
2
2
1
1
Platforms
4
2
1
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects use of WHOIS web services for domain property enumeration
This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.
This rule detects WHOIS queries directed to internal services within the network. It specifically looks for TCP traffic on port 43 (the standard WHOIS port) flowing from any source to the internal network. A threshold of 5 queries within 60 seconds from the same source is set to reduce noise, indicating a potential network scan or reconnaissance activity.
KQL Query from file: Honeypot Threat Intelligence (TI) Data
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
