dns | Detection.FYI

Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·
Share on:

Detects suspicious DNS queries to Monero mining pools

Read More
Cobalt Strike DNS Beaconing

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

Read More
DNS Query to External Service Interaction Domains

Aug 12, 2024 · attack.initial-access attack.t1190 attack.reconnaissance attack.t1595.002 ·
Share on:

Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE

Read More
DNS TXT Answer with Possible Execution Strings

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects strings used in command execution in DNS TXT Answer

Read More
Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries using base64 encoding

Read More
Telegram Bot API Request

Aug 12, 2024 · attack.command-and-control attack.t1102.002 ·
Share on:

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Read More
Wannacry Killswitch Domain

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects wannacry killswitch domain dns queries

Read More