Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
32
9
6
1
Contributors
10
8
6
6
6
Categories
35
13
8
6
4
Platforms
28
15
5
4
3
Products / Services
13
9
6
5
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
2
IDS Protocols
3
3
The following analytic detects the use of the dnscmd.exe command to enumerate DNS records. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. This activity is significant as it may indicate an adversary gathering network information, a common precursor to more targeted attacks. If confirmed malicious, this behavior could enable attackers to map the network, identify critical assets, and plan subsequent actions, potentially leading to data exfiltration or further compromise of the network.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
This rule detects when a DNS server receives a zone transfer request for a non-existent or non-authoritative zone, indicated by EventID 6004 from the Microsoft-Windows-DNS-Server-Service. This event signifies an attempt to perform a DNS zone transfer that was rejected by the DNS server. Such attempts can be part of reconnaissance activities by adversaries trying to map out a network's DNS infrastructure.
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. Specifically looks for messages related to dropping source port zero packets, denied AXFR requests, and fatal errors causing an exit.
This rule detects the execution of 'adidnsdump' via 'python.exe'. Adidnsdump is a tool used for enumerating and exporting all DNS records in an Active Directory integrated DNS zone. This activity is typically performed for reconnaissance purposes within internal networks, allowing an attacker to gather information about the network's structure and resources by querying/modifying DNS records via LDAP.
Detects when a DNS zone transfer failed.
Page 3 of 3