Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
32
9
6
1
Contributors
10
8
6
6
6
Categories
35
13
8
6
4
Platforms
28
15
5
4
3
Products / Services
13
9
6
5
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
2
IDS Protocols
3
3
Detects an abnormally high volume of unique DNS subdomain queries originating from a single source IP address within a short time window. This behavior is often indicative of automated reconnaissance techniques, such as subdomain brute-forcing or dictionary attacks, used to discover infrastructure or hidden services.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
This KQL inventories activity associated with a specified root domain and its subdomains across DeviceNetworkEvents, EmailUrlInfo, CloudAppEvents.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects the use of the PowerShell cmdlet 'Get-DnsServerResourceRecord' to enumerate DNS zone records. Attackers frequently use this technique to map out network infrastructure, identify internal assets, and discover target subnets within an Active Directory environment.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
Detects potential reconnaissance activities directed at a domain controller, specifically monitoring for DNS zone transfer (AXFR) requests or unusually high volumes of DNS 'ANY' queries. These behaviors are often associated with adversaries attempting to map network infrastructure or discover internal resources.
Detects potential reconnaissance activities directed at a domain controller, specifically monitoring for DNS zone transfer (AXFR) requests or unusually high volumes of DNS 'ANY' queries. These behaviors are often associated with adversaries attempting to map network infrastructure or discover internal resources.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
Detects IP geolocation lookups used to gather target network information
Detects high-rate DNS queries indicating subdomain enumeration
Detects DNS AXFR zone transfer requests used for network reconnaissance
Detects high-rate DNS queries used for network topology and configuration discovery
Detects queries to certificate transparency logs for subdomain discovery
This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.
DNS Full Zone Transfer Request
Suricata
This rule detects a DNS Full Zone Transfer Request. A zone transfer is a type of DNS transaction used to replicate DNS database files (zone files) from a primary DNS server to a secondary DNS server. While legitimate for DNS server synchronization, unauthorized zone transfers can be used by attackers to gather extensive information about a network's infrastructure, including hostnames, IP addresses, and other sensitive data, which can then be used for further reconnaissance and targeting. The rule specifically looks for UDP traffic to port 53 (DNS) and the content '|00 FC|' at offset 2, which corresponds to the AXFR (Authoritative Zone Transfer) query type.
Page 1 of 3