Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,443
11,831
5,875
5,151
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
This rule detects unusual outbound network connections from devices to well-known public DNS servers (Google DNS, Cloudflare DNS, Quad9, OpenDNS) on ports other than the standard DNS (53), HTTP (80), or HTTPS (443) ports. A high number of such connections (5 or more within an hour) could indicate command and control activity, data exfiltration, or the use of DNS tunneling.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects non-browser processes initiating HTTPS network connections to well-known public DNS over HTTPS (DoH) resolvers. This behavior is often associated with command and control (C2) communication, where malware attempts to evade network security controls by tunneling DNS queries through encrypted HTTPS traffic.
This rule detects email events where the sender's domain fails basic DNS resolution, indicating it might be non-existent or invalid, but the email successfully bypasses authentication due to SPF macros. This could be an attempt to spoof emails from non-existent domains while still appearing legitimate to email authentication checks.
Detects the Gamaredon implant executing DNS resolution checks through the public proxy utility check-host.net to map active fast flux IPs. This activity is initiated by wscript.exe or mshta.exe.
This rule detects DNS queries to known dynamic DNS providers, which can be indicative of Command and Control (C2) infrastructure. Adversaries often use dynamic DNS services to maintain persistent access to compromised systems, as the IP addresses of their C2 servers may change frequently. The rule specifically looks for queries containing domains like duckdns.org, no-ip.com, ddns.net, hopto.org, zapto.org, and sytes.net.
This rule detects unusual outbound network connections from devices to well-known public DNS servers (Google DNS, Cloudflare DNS, Quad9, OpenDNS) on ports other than the standard DNS (53), HTTP (80), or HTTPS (443) ports. A high number of such connections (5 or more within an hour) could indicate command and control activity, data exfiltration, or the use of DNS tunneling.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects network connections or DNS queries to the specific link-aggregation domain 'fanlnk.to'. This domain is known to be abused by the threat actor SniperDz to mask the destination of malicious social media lures, often leading to phishing or malware delivery.
Detects DNS-based data exfiltration via high-volume TXT record queries
This rule detects devices making a high volume of DNS queries (50 or more within a 5-minute window) to domains that have 4 or more subdomains and are not common legitimate services like microsoft.com, google.com, or amazon.com. This pattern can be indicative of DNS beaconing, a technique used by adversaries for command and control (C2) communication or data exfiltration.
This rule detects a multi-stage command and control (C2) domain rotation pattern by identifying DNS queries for domains that match a specific regular expression. The pattern looks for domains consisting of 6 to 12 lowercase alphanumeric characters followed by one of several top-level domains (xyz, top, icu, club, online). A threshold of 5 such queries from the same source within 60 seconds is used to trigger the alert, indicating potential malicious activity like fast flux or domain generation algorithms (DGAs) used by malware for C2 communication.
Detects high-rate DNS queries indicating subdomain enumeration
Detects DNS AXFR zone transfer requests used for network reconnaissance
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Page 53 of 77