Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,437
11,828
5,871
5,150
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects malicious network connections, file downloads, or process execution associated with the REVSTEALER malware campaign, which utilizes hijacked YouTube channels to distribute fake game-cheat videos that lure users into downloading 'resightloader.exe' from specific malicious domains.
Detects instances where PowerShell is used to download an executable named 'svchost.exe' from an external IP address (103.86.86.244). The rule monitors for network connections to this IP, file creation events matching specific download patterns in fonts directories, and direct command-line arguments involving the suspicious IP and file path, indicating potential malware dropper activity.
Detects instances where common web browsers (Chrome, Edge, Firefox, IE) download executable or compressed files to drives other than the C: drive. This behavior may indicate an attempt to evade standard security monitoring or hide malicious payloads on secondary volumes or removable media.
This is something I have seen many times during my years working in cybersecurity: users download software with a filename they recognize and trust, but the file behind that name can be something completely different.
Monitoring the filename is not enough. Monitoring the hash is better, but legitimate software changes constantly: new version, new SHA256, another hash to validate and maintain. So I started thinking about how AI agents could help us here — not by deciding what is malicious, but by doing the repetitive work for us.
For this research, I built an AI-maintained baseline of legitimate software and used it from KQL to hunt two different scenarios:
🎯 Known filename + Unknown hash + Untrusted download source
Monitoring the filename is not enough. Monitoring the hash is better, but legitimate software changes constantly: new version, new SHA256, another hash to validate and maintain. So I started thinking about how AI agents could help us here — not by deciding what is malicious, but by doing the repetitive work for us.
For this research, I built an AI-maintained baseline of legitimate software and used it from KQL to hunt two different scenarios:
🎯 Known filename + Unknown hash + Untrusted download source
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
Detects the execution of package managers (pip or npm) to install software dependencies initiated by development or agent-related processes (like IDEs or background services) in a non-interactive session. This behavior can be indicative of automated dependency confusion attacks, malicious supply chain activity, or unauthorized package installation occurring without direct user oversight.
Detects the execution of package managers (pip or npm) to install software dependencies initiated by development or agent-related processes (like IDEs or background services) in a non-interactive session. This behavior can be indicative of automated dependency confusion attacks, malicious supply chain activity, or unauthorized package installation occurring without direct user oversight.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
Detects the execution of package managers (pip or npm) to install software dependencies initiated by development or agent-related processes (like IDEs or background services) in a non-interactive session. This behavior can be indicative of automated dependency confusion attacks, malicious supply chain activity, or unauthorized package installation occurring without direct user oversight.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
This rule detects suspicious PowerShell execution that attempts to download files from the internet using the Invoke-WebRequest cmdlet. It specifically looks for PowerShell processes launched with hidden and execution policy bypass flags, coupled with specific hardcoded malicious URL patterns associated with a known campaign (NotaFiscal/nfe_valid_access_key_2026_secure).
Detects instances where Faronics Core related processes (FaronicsCore.exe, NCService.exe, ScriptRunner.exe) spawn common system utilities (curl.exe, mshta.exe, msiexec.exe) often used for downloading or executing payloads. This pattern may indicate the abuse of legitimate management software to facilitate unauthorized activity or second-stage payload delivery.
Detects package installation activities involving potentially compromised TanStack packages during the defined malicious publish window (2026-05-11 to 2026-05-12). The rule monitors common Node.js package managers (npm, pnpm, yarn, bun) and CLI tools for commands attempting to fetch identified affected versions of @tanstack/* libraries.
Detects the use of PowerShell (Invoke-WebRequest or Invoke-RestMethod) to download files to the AppData directory, followed by the execution of a file using a 'token-raw' argument. This pattern is often associated with malicious payload delivery and execution.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule identifies potential phishing emails that impersonate OneDrive sharing notifications. It correlates email messages containing keywords typically associated with document sharing (e.g., 'OneDrive', 'shared', 'file') with subsequent user URL clicks. Crucially, the rule filters for clicks to domains that are not explicitly related to legitimate OneDrive, SharePoint, or 1drv.ms hosting, indicating a potential attempt to lure users to a malicious third-party site under the guise of file sharing.
This rule detects the creation, modification, or renaming of a file named '/tmp/helper' within a one-day window of a 'curl' or 'wget' command-line execution that references this specific path. This pattern is commonly indicative of an adversary downloading and staging malicious tools or payloads in a temporary directory on Linux systems.
Detects the ProRAM macOS ARM64 Mach-O implant, identified by specific internal codesign strings, download URLs (cloudfront.net/helper), and local file drop paths ($HOME/updated) consistent with the Funnull threat actor's activity.
This rule detects suspicious file downloads initiated by common browsers from a specific remote domain ('reficon.pro') associated with '/vizio.com/'. It enriches this activity by checking for prior beaconing activity to 'stats.us3.org' (often used for Matomo analytics), which may indicate a multi-stage attack where an initial profiling beacon precedes a malicious payload download.
Page 32 of 76