Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
ET INFO DYNAMIC_DNS Query to a *.anchorchain .co .za domain
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (forrbes .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (varorg .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (cronapiworkersvc .com)
ET INFO VNT VPN Domain in DNS Lookup (vnt .wherewego .top)
ET INFO VNT VPN Domain in DNS Lookup (vnt .8443 .eu .org)
ET INFO DYNAMIC_DNS HTTP Request to a *.hornburst .com domain
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (dotauan .pro)
ET MALWARE Observed DNS Query to Malicious Domain (significant-adopted-bearing-own .trycloudflare .com)
ET INFO Blockchain RPC Domain in DNS Lookup (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in DNS Lookup (arbitrum .one)
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
DNS TOR Proxies
Sigma
Identifies IPs performing DNS lookups associated with common Tor proxies.
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shoplerter .opnetorologies .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
ET INFO Blockchain RPC Domain in DNS Lookup (polygon-rpc .com)
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .optimism .io)
ET INFO Blockchain RPC Domain in TLS SNI (cloudflare-eth .com)
Page 65 of 77