Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
32
9
6
1
Contributors
10
8
6
6
6
Categories
35
13
8
6
4
Platforms
28
15
5
4
3
Products / Services
13
9
6
5
3
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
2
2
2
IDS Protocols
3
3
This rule detects DNS queries for Mail Exchanger (MX) records. A high volume of MX record lookups from a single source IP address within a short timeframe (10 queries in 30 seconds) is indicative of network scanning activity, specifically reconnaissance to discover mail servers. This could be a precursor to targeted attacks like phishing or email spoofing.
This rule detects a DNS incremental zone transfer request. This type of request is used to synchronize DNS zone data between DNS servers. While legitimate in some network configurations, it can also be abused by attackers during reconnaissance to gather information about a network's internal structure.
Detects AXFR DNS zone transfer requests for network reconnaissance
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
ET INFO Blockchain RPC Domain in DNS Lookup (api .avax .network)
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .infura .io)
This rule detects indicators of compromise (IOCs) associated with the 'ManualFinder/PDF Editor' malware campaign. It identifies malicious activity across multiple data sources, including file hashes, process hashes, suspicious certificate signers, suspicious company names in version info, suspicious file descriptions, malicious command execution, and network connections to known command and control (C2) or malicious PDF-related domains. The rule leverages external data sources for IOCs such as file hashes, C2 domains, PDF-related domains, suspicious signers, and malicious commands. It also includes static IOCs like specific file descriptions and company names. The detection logic is designed to identify various stages of the malware's activity, from initial execution to network communication.
KQL Query from file: Direct Send Abuse Detection
KQL Query from file: CVE-2025-33073 Detection
KQL Query from file: LDAPNightmare POC Detection
KQL Query from file: Hunting Zloader DNS Tunneling
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
Detects when a DNS zone transfer failed.
'This query helps identify rare DNS connections and resulting data transfer to/from the associated domain. It can help identify unexpected large data transfers to or from internal systems which may indicate data exfil or malicious tool download.'
Device Network Events Involving Low Count FQDNs.
This query reduces network events to only those with the RemoteURL column populated,.
Then parses the DNS name from the URL (if needed) and finds the least prevalent.
FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous.
Network communication.
This query reduces network events to only those with the RemoteURL column populated,.
Then parses the DNS name from the URL (if needed) and finds the least prevalent.
FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous.
Network communication.
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Get information about the netwotk adapters of the given computer in the given time.
This could include the configured IP addresses, DHCP servers, DNS servers, and more.
This could include the configured IP addresses, DHCP servers, DNS servers, and more.
'This query identifies matches based on domain IOCs related to KNOTWEED against Microsoft Defender for Endpoint device network connections'
This query will count the number of devices in Defender ATP based
on their DNS suffix. For a full list of devices with the DNS
suffix, comment out or remove the last line.
on their DNS suffix. For a full list of devices with the DNS
suffix, comment out or remove the last line.
Detects an attempt to leverage dnscmd.exe to enumerate DNS zones or records of a domain. This activity can be indicative of reconnaissance by an attacker.
Page 2 of 3