Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
55
42
22
10
3
Contributors
39
25
25
15
8
Categories
76
23
17
11
8
Platforms
88
37
17
10
3
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
36
35
33
25
23
CVEs
6
3
3
3
1
IDS Classtypes
1
IDS Protocols
1
The analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. It leverages Splunk Stream DNS and TCP data to identify DNS SIG and KEY records, as well as TCP payloads exceeding 65KB. This activity is significant because SIGRed is a critical wormable vulnerability that allows remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially disrupt services, leading to severe data breaches and infrastructure compromise. Immediate investigation and remediation are crucial to mitigate these risks.
The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" path. This activity is significant as it was observed in the Hermetic Wiper malware, indicating potential malicious intent to alter file attributes and user interface elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities.
This rule detects DNS queries for domains that have a very low rolling maximum prevalence (3 or less over a 10-day period). This can indicate newly registered domains, domains used for command and control, or other suspicious activity that has not yet gained widespread legitimate use. The rule correlates DNS events with derived prevalence data to identify these low-prevalence domains.
This rule detects DNS queries made by the Azure Hybrid Connection Manager service to the Azure Service Bus service. This activity is considered suspicious because it could indicate an attempt to establish persistence or exfiltrate data through a compromised Hybrid Connection Manager, leveraging the Service Bus as a communication channel.
This rule detects DNS queries to specific malicious domains associated with the GALLIUM threat group, as identified by Microsoft Threat Intelligence Center in December 2019. The rule specifically looks for Event ID 257 in the Microsoft-Windows-DNS-Server/Analytical log, where the queried domain name (QNAME) matches a predefined list of indicators.
zeek_dns_nkn
Sigma
NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
Detects suspicious DNS queries using base64 encoding
The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Detects when a DNS zone transfer failed.
Page 7 of 7