Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
55
42
22
10
3
Contributors
39
25
25
15
8
Categories
76
23
17
11
8
Platforms
88
37
17
10
3
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
36
35
33
25
23
CVEs
6
3
3
3
1
IDS Classtypes
1
IDS Protocols
1
Detects DNS resolution and outbound network connection attempts to the hardcoded C2 domain 'aroclenetapp.net' associated with the SynkLoader StreamMaster reverse VNC module. This module is used to exfiltrate screenshots and capture keyboard/mouse input.
Detect DNS tunnelling via long subdomain labels. The query is useful for identifying DNS queries with unusually long request strings (typically 40+ characters per label) and high volumes of repetitive requests used by attackers to exfiltrate data or run command-and-control (C2) channels.
Detects endpoint activity indicative of the TELEPUZ malware interacting with the Telegram API to resolve its fallback Command and Control (C2) server. The rule monitors for DNS queries, network connections, and security log entries related to the specific channel 'chanadarkpart' and common Telegram API endpoints used for retrieving message data or user profiles.
Detects the use of the PowerShell cmdlet 'Get-DnsServerResourceRecord' to enumerate DNS zone records. Attackers frequently use this technique to map out network infrastructure, identify internal assets, and discover target subnets within an Active Directory environment.
Detects DNS queries with exceptionally long request strings (30 characters or more), which is a common indicator of DNS tunneling or command and control (C2) communication. Adversaries often encode data within the subdomain portion of a DNS query to bypass network security controls.
Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects potential reconnaissance activities directed at a domain controller, specifically monitoring for DNS zone transfer (AXFR) requests or unusually high volumes of DNS 'ANY' queries. These behaviors are often associated with adversaries attempting to map network infrastructure or discover internal resources.
This rule detects DNS queries with suspicious characteristics that may indicate DNS tunneling, data exfiltration, or command and control activity. It identifies queries with unusually long names, long first labels combined with high entropy, or a high number of subdomains combined with a long first label. Exclusions are made for common legitimate DNS suffixes and specific service-related domains.
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
Detects DNS queries with exceptionally long request strings (30 characters or more), which is a common indicator of DNS tunneling or command and control (C2) communication. Adversaries often encode data within the subdomain portion of a DNS query to bypass network security controls.
This rule detects DNS queries with suspicious characteristics that may indicate DNS tunneling, data exfiltration, or command and control activity. It identifies queries with unusually long names, long first labels combined with high entropy, or a high number of subdomains combined with a long first label. Exclusions are made for common legitimate DNS suffixes and specific service-related domains.
Detects potential reconnaissance activities directed at a domain controller, specifically monitoring for DNS zone transfer (AXFR) requests or unusually high volumes of DNS 'ANY' queries. These behaviors are often associated with adversaries attempting to map network infrastructure or discover internal resources.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects DNS lookups to Pastebin used for dead drop C2 configuration retrieval
This rule detects potential DNS tunneling activity by looking for an unusually high volume of DNS queries of type TXT or NULL, or DNS queries with exceptionally long names (50 characters or more), originating from multiple distinct clients within a one-hour window. This pattern is often indicative of adversaries exfiltrating data or establishing command and control through DNS.
Detects the execution of dnscmd.exe to enumerate DNS records, which can be used by adversaries to gather internal network infrastructure information.
Detects network connections to the Session P2P exfiltration infrastructure used by the Mini Shai-Hulud campaign.
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
Page 3 of 7