Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,456
11,839
5,876
5,155
4,865
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule detects repeated DNS queries to known Dynamic DNS (DDNS) providers within a 24-hour window, which may indicate an infected host beaconing to a command-and-control (C2) server utilizing dynamic infrastructure. Such rotation is commonly used by malware to maintain connectivity if primary infrastructure is blocked.
This rule monitors build agent processes (e.g., Jenkins, Bamboo, Gradle, MSBuild) for suspicious DNS activity. It alerts when these processes resolve a high volume (3 or more) of unique external domains that are not associated with typical development, build, or dependency management platforms (e.g., Microsoft, Azure, GitHub, NPM, PyPI, Maven, Sonatype). This behavior may indicate an attempt by an adversary to reach command-and-control servers or exfiltrate data from a compromised build environment.
Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.
Detects the execution of system information discovery utilities (systeminfo, ipconfig, whoami, net) by specific process names (BQT.exe or start.exe), followed by a DNS request to api.telegram.org within a 30-minute window. This behavior is indicative of malware performing reconnaissance and using Telegram for command and control or data exfiltration.
Detects activity associated with the TA4922 (Silver Fox) threat actor, specifically involving Atlas RAT and RomulusLoader. The detection logic utilizes four primary telemetry sources: network connections to known C2 IP addresses, DNS queries for the 'srt.tw' domain, suspicious outbound connections from user-writable directories (AppData, Temp, etc.) over non-standard ports, and the execution of a specific malicious ZIP archive file identified by its SHA256 hash.
Detects anomalous, high-volume DNS query activity where a process attempts to resolve 20 or more unique domains within a 2-minute window. The query patterns match strings that are 8-20 characters long with common top-level domains, excluding known web browsers and standard network diagnostic utilities. This behavior is indicative of malware using Domain Generation Algorithms (DGA) for command and control or secondary communication channels.
Detects instances where node.js or npm processes access multiple sensitive configuration or credential files (such as .aws/credentials, .npmrc, .pypirc, .gitconfig, or docker configs) and subsequently perform DNS queries against known malicious or suspicious C2 domains.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects potential DNS exfiltration attempts by monitoring DNS query responses for specific keywords ('exfil', 'data', 'c2') in the remote DNS name. It flags devices that make 20 or more such suspicious DNS queries within an hour, indicating a high volume of potentially malicious DNS activity often associated with DNS tunneling or data exfiltration.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
This rule detects potential command and control (C2) beaconing activity associated with the OilRig threat group's BONDUPDATER/ALMA Communicator malware. It identifies suspicious, highly regular DNS TXT record queries (QueryType 16) originating from common system tools like nslookup.exe, powershell.exe, or cmd.exe. The detection logic calculates the statistical regularity of query intervals to identify automated beaconing patterns, which is a hallmark of C2 communication using DNS tunneling or data exfiltration via DNS.
Detects outbound network connections to known BumbleBee loader and AdaptixC2 infrastructure, or DNS lookups for BumbleBee download gateway domains. The rule further filters these network events by inspecting the source process to ensure it matches common LOLBAS (Living Off the Land Binary and Scripting) utilities or execution from temporary user paths, indicating potential malicious payload retrieval.
Detects anomalous network traffic patterns from SOHO/IoT and edge devices indicative of Tor-based C2 communication, including DNS queries for .onion domains, outbound connections to known Tor relay ports, and high-volume encrypted traffic over non-standard high-range ports.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
This rule detects potential DNS exfiltration attempts by identifying DNS queries containing high-entropy subdomains of 51 characters or more, encoded in Base64. Adversaries may use long, encoded subdomains to tunnel data out of a network through the DNS protocol, bypassing traditional security controls.
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
This rule detects potential command and control (C2) activity leveraging DNS tunneling. It identifies high-frequency DNS queries that contain unusually long subdomain labels (51 characters or more), which is a common technique used to encode data or commands within DNS protocol traffic to bypass network security controls.
Detects high-volume, established TLS connections to common public DNS-over-HTTPS (DoH) providers (Google, Cloudflare, OpenDNS). Persistent high-frequency connections to these resolvers can be indicative of DNS tunneling, where an adversary encapsulates command-and-control or data exfiltration traffic within encrypted DNS queries to bypass network monitoring.
This rule detects potential command and control (C2) beaconing activity using DNS by identifying high-frequency, long, and random subdomain queries. It monitors for DNS requests that exceed 40 bytes in size, feature complex alphanumeric subdomains, and exceed a defined threshold of 10 requests within a 60-second window, which is indicative of DNS tunneling or command-and-control exfiltration.
Page 41 of 77