Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,443
11,831
5,875
5,151
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
ET INFO Blockchain RPC Domain in DNS Lookup (cloudflare-eth .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guiasexo .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shop)
ET INFO DYNAMIC_DNS Query to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (graffetti .com)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (fellsminjs .com)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (polimakels .com)
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network traffic to 'cloudflariz.com', a known Command and Control (C2) domain associated with the Qilin RaaS group. An alert from this rule is a high-fidelity indicator of compromise.
_ldap._tcp.dc._msdcs.ad.domain.com is a DNS query used by AD clients to locate Domain Controllers that can provide LDAP services for the ad.domain.com domain, ensuring users and computers can authenticate, query directory data, and function inside the AD forest.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
Detects DNS queries containing specific base64-encoded patterns ("UWhRCA" and "BAAAA") that are indicative of Kerberos coercion attacks via DNS object spoofing. This technique involves manipulating DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, forcing victim systems to authenticate to attacker-controlled hosts. This is a strong indicator of a Kerberos coercion attack, potentially related to vulnerabilities like CVE-2025-33073, where a marshaled CREDENTIAL_TARGET_INFORMATION structure is used.
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
Page 66 of 77