| sigma |
Nslookup PowerShell Download Cradle - ProcessCreation |
test |
2026-10-13 |
| elastic |
Network Activity to a Suspicious Top Level Domain |
production |
2026-10-09 |
| splunk |
Windows DNS Query Request by Telegram Bot API |
production |
2026-10-06 |
| elastic |
GenAI Process Connection to Suspicious Top Level Domain |
production |
2026-09-25 |
| splunk |
Windows AI Platform DNS Query |
production |
2026-09-22 |
| elastic |
Potential DNS Tunneling via NULL or Long DNS Queries |
production |
2026-09-21 |
| elastic |
Unusual Network Destination Domain Name |
production |
2026-09-18 |
| elastic |
Unusual DNS Activity |
production |
2026-09-18 |
| elastic |
DNS Tunneling |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a DNS Request Predicted to be a DGA Domain |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a DNS Request With a High DGA Probability Score |
production |
2026-09-18 |
| elastic |
Potential DNS Tunneling via NsLookup |
production |
2026-09-18 |
| elastic |
Potential DGA Activity |
production |
2026-09-18 |
| elastic |
Uncommon DNS Request via Bun or Node.js |
production |
2026-09-18 |
| elastic |
Machine Learning Detected DGA activity using a known SUNBURST DNS domain |
production |
2026-09-18 |
| elastic |
System Public IP Discovery via DNS Query |
production |
2026-09-18 |
| elastic |
Potential Command and Control via Internet Explorer |
production |
2026-09-18 |
| splunk |
DNS Kerberos Coercion |
production |
2026-09-08 |
| splunk |
Windows Powershell Commands from DNS TXT |
production |
2026-07-30 |
| splunk |
Windows Visual Basic Commandline Compiler DNSQuery |
production |
2026-05-13 |
| splunk |
Windows Credential Target Information Structure in Commandline |
production |
2026-05-13 |
| splunk |
Windows Kerberos Coercion via DNS |
production |
2026-05-13 |
| splunk |
Windows Short Lived DNS Record |
production |
2026-05-13 |
| splunk |
Excessive DNS Failures |
experimental |
2026-05-13 |
| sigma |
Network Connection Initiated via Finger.EXE |
experimental |
2025-11-19 |
| sigma |
DNS Query by Finger Utility |
experimental |
2025-11-19 |
| sigma |
Low Reputation Effective Top-Level Domain (eTLD) |
experimental |
2025-08-04 |
| sigma |
DNS Query To Common Malware Hosting and Shortener Services |
experimental |
2025-06-02 |
| sigma |
DNS Query To Katz Stealer Domains - Network |
experimental |
2025-05-22 |
| sigma |
DNS Query To Katz Stealer Domains |
experimental |
2025-05-22 |
| sigma |
Silence.EDA Detection |
test |
2023-04-03 |
| sigma |
OilRig APT Activity |
test |
2023-03-08 |
| sigma |
OilRig APT Schedule Task Persistence - System |
test |
2023-03-08 |
| sigma |
OilRig APT Schedule Task Persistence - Security |
test |
2023-03-08 |
| sigma |
OilRig APT Registry Persistence |
test |
2023-03-08 |
| sigma |
Suspicious Cobalt Strike DNS Beaconing - Sysmon |
test |
2023-01-16 |
| sigma |
Suspicious Cobalt Strike DNS Beaconing - DNS Client |
test |
2023-01-16 |
| sigma |
Cobalt Strike DNS Beaconing |
test |
2022-10-09 |
| sigma |
Suspicious DNS Query with B64 Encoded String |
test |
2022-10-09 |
| sigma |
DNS TXT Answer with Possible Execution Strings |
test |
2021-11-27 |
| sigma |
DNS Exfiltration and Tunneling Tools Execution |
test |
2021-11-27 |