Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
2
1
Contributors
3
1
1
Categories
2
2
2
2
1
Platforms
3
3
1
1
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
Detects queries to passive DNS databases for historical DNS resolution data
This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.
This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.
KQL Query from file: defendnot detection
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
