Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,456
11,839
5,876
5,155
4,865
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule detects the addition of TXT or CNAME records within Azure-managed DNS zones that correspond to third-party email sending platforms, specifically Amazon SES or Resend. It monitors for the creation of DKIM selectors or SPF records that authorize these services to send emails on behalf of the organization's domain, which can be used to facilitate email spoofing or phishing.
This rule identifies potential DNS tunneling or exfiltration attempts by monitoring for high volumes of DNS queries, a high count of distinct subdomains, or the usage of unusual DNS record types (TXT, NULL) within Zscaler Internet Access logs.
Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.
Detects a sequence of events where a user visits a known ClickFix Traffic Direction System (TDS) domain and subsequently executes an obfuscated 'curl' command via the Terminal application on macOS. This pattern is indicative of a ClickFix campaign where users are socially engineered into pasting malicious code snippets to resolve fake browser errors.
This rule detects DNS configuration changes (via 'netsh' commands or registry modifications to the 'NameServer' value) initiated by specific system processes ('SwiService.exe' or 'svchost.exe') shortly after a Plug-and-Play (PnP) event, such as a USB drive connection. This pattern is indicative of potential malicious activity attempting to redirect DNS queries upon the insertion of unauthorized hardware.
Detects DNS queries to the broader set of UNC6671/Blackfile/Pink/Falcon passkey- and SSO-themed lookalike phishing domains used across the campaign's rebrand clusters.
This rule detects DNS configuration changes (via 'netsh' commands or registry modifications to the 'NameServer' value) initiated by specific system processes ('SwiService.exe' or 'svchost.exe') shortly after a Plug-and-Play (PnP) event, such as a USB drive connection. This pattern is indicative of potential malicious activity attempting to redirect DNS queries upon the insertion of unauthorized hardware.
Detect DNS tunnelling via long subdomain labels. The query is useful for identifying DNS queries with unusually long request strings (typically 40+ characters per label) and high volumes of repetitive requests used by attackers to exfiltrate data or run command-and-control (C2) channels.
Detects outbound network connections and DNS queries to a maintained list of known UNC6671 extortion-related domain names. The rule utilizes a temporal 'recency' window (aged IOCs) to filter out stale indicators, mitigating false positives caused by sinkholed or reassigned infrastructure.
Detects DNS query bursts from a single source to a predefined set of domains mimicking passkey or single-sign-on (SSO) login portals. These domains are known to be part of the infrastructure used by the UNC6671 threat actor for credential harvesting activities.
Detects network and DNS traffic targeting known infrastructure used by the Forg365 adversary-in-the-middle (AiTM) phishing kit. This kit clones Microsoft login pages to intercept credentials and session cookies via reverse proxy.
UNC6671 AiTM passkey/SSO lookalike domain DNS query
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by correlating network events indicating a connection to a known phishing domain with subsequent suspicious authentication behavior. Specifically, it identifies sessions associated with non-corporate IP addresses that show evidence of token reuse (e.g., multiple distinct IP addresses for the same session identifier) occurring within a short window after accessing a phishing portal.
Detects high-volume DNS TXT/A queries to domains containing "microsoft" within a 1-hour window per host, indicative of DeviceManager RAT DNS tunneling activity disguised as Microsoft telemetry traffic.
Detects DNS queries to mangorbit.com and its subdomains, C2 infrastructure associated with the Open VSX Evil Twin extensions campaign
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
This rule monitors DNS queries for the domain 'veyko-service.org', which is identified as being associated with the NodeSnake RAT (Remote Access Trojan). The detection indicates potential command-and-control (C2) activity where an infected host attempts to reach a malicious infrastructure domain.
Detects DNS queries matching known malicious infrastructure domains identified in SourTrade malvertising campaigns. These domains are often used by threat actors to host malicious payloads or C2 infrastructure.
This rule detects DNS queries for the domain 'xoredo-srv.com', which is associated with the INTERLOCK NodeSnake RAT for command and control communications.
Page 36 of 77