Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,432
11,818
5,871
5,150
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the download and execution of the malicious v7.msi installer from the domain camorreado.click. This file acts as a loader for the EtherRAT Node.js RAT, often delivered in the context of fake IT support phishing campaigns. The rule monitors both network connection events to the malicious domain and process creation events involving msiexec.exe execution of the specific MSI payload.
Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.
Detects the use of PowerShell's .NET WebClient class to download and execute potentially malicious files. The rule monitors for common indicators of in-memory or on-disk file downloading, such as Headers.Add being used to set a User-Agent, and the DownloadData method being invoked. It specifically flags common filenames associated with stage, update, or privilege escalation payloads.
This rule monitors proxy and network detection and response (NDR) logs for outbound HTTPS requests to Cloudflare R2 (*.r2.dev) and Cloudflare Pages (*.pages.dev) domains. These platforms are frequently abused by adversaries for hosting malicious payloads, particularly in ClickFix-style social engineering campaigns. The rule specifically flags connections that involve the download of common executable, script, or archive file extensions, as well as recurring traffic patterns to these domains.
Detects the use of living-off-the-land binaries (mshta.exe, regsvr32.exe, certutil.exe, or wmic.exe) when executing with network-related or decoding command-line arguments. The rule specifically flags these invocations when they originate from parent processes not typically associated with legitimate system administration or software deployment workflows, targeting potential command-chain abuse or payload staging.
Detects the use of BITSAdmin to create or manage BITS jobs using specific command-line flags that include suspicious external file paths or URLs, which are commonly associated with malicious downloader activity.
Detects network connection events where the requested URL contains 'dogleash' and includes common architecture suffixes (mips, arm, x64) or shell script extensions (.sh), often indicative of downloading stage payloads associated with the Dogleash malware family.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
Detects the use of a common PowerShell download cradle (Invoke-Expression with Invoke-RestMethod) targeting a direct IP address. This pattern is frequently observed in 'ClickFix' style attacks where users are tricked into copying and pasting malicious commands into their terminal, which then pull secondary payloads from adversary-controlled infrastructure.
Detects anomalous PowerShell activity associated with the EKZ Stealer, characterized by a multi-stage chain involving file download, hidden process execution, temporary file staging, base64 encoding, and exfiltration via HTTP POST requests, followed by cleanup of logs.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.
Detects the autonomous execution of package manager commands (pip, npm, yarn) initiated by processes associated with AI agent pipelines, automation scripts, or CI/CD runners. This behavior is indicative of potential malicious activity where automated agents may be tricked into installing hallucinated or malicious packages from untrusted domains without human oversight.
This rule detects suspicious activity involving the BITSAdmin (bitsadmin.exe) utility, which is a known LOLBin (Living Off the Land Binary). It monitors for the creation of BITS jobs using suspicious flags (e.g., /transfer, /setnotifycmdline) potentially indicating external file downloads, as well as the execution of known command interpreters or utilities spawned as child processes by BITSAdmin, which is a common post-exploitation technique for persistence or secondary payload execution.
Detects outbound network connections from common package managers (pip, npm) or utility tools (node, wget, curl) to destinations that are not related to official package repositories or local network ranges. This behavior may indicate an adversary using legitimate tools to download malicious payloads or establish command and control channels.
Page 36 of 76