Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the creation of .ics calendar invitation files in common user download and temporary directories when originated by web browsers or Microsoft Outlook. This pattern is often indicative of spearphishing campaigns where attackers use weaponized calendar files to deliver malicious payloads or links, attempting to exploit users through social engineering.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
This rule detects scenarios where a common web browser (Chrome, Firefox, Edge, IE, Opera, or Brave) connects to an external destination not on a known allow-list, followed shortly (within 30 seconds) by the execution of a script-based binary (wscript.exe or mshta.exe) on the same host. This is a common pattern for initial access where a user downloads a malicious script from an unknown source via a browser and subsequently executes it.
This rule detects the execution of RMM (Remote Monitoring and Management) installers (Atera or SimpleHelp) via msiexec.exe or setup.exe when launched from directories commonly used for downloads (Temp/Downloads) and originating from web browsers or Microsoft Office applications. This behavior is indicative of a potential drive-by download or phishing attack aimed at installing unauthorized remote access software.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from common public file sharing and code repository sites, which is a known technique for adversaries to stage or download malicious payloads.
This rule detects scenarios where a common web browser (Chrome, Firefox, Edge, IE, Opera, or Brave) connects to an external destination not on a known allow-list, followed shortly (within 30 seconds) by the execution of a script-based binary (wscript.exe or mshta.exe) on the same host. This is a common pattern for initial access where a user downloads a malicious script from an unknown source via a browser and subsequently executes it.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
This rule monitors for potentially malicious use of the Windows Certutil utility, specifically targeting the -urlcache (often used to download remote files) and -decode (used to decode hidden or obfuscated payloads) command-line arguments. It filters out common trusted processes like Microsoft's msiexec.exe to reduce noise.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate background data transfer jobs pointing to non-Microsoft or non-Windows Update domains. This technique is commonly used by adversaries for C2 communication or to download malicious payloads.
Detects the use of BITSAdmin or the PowerShell Start-BitsTransfer cmdlet for downloading files from the internet or local network, often used by attackers to perform ingress tool transfer or to maintain persistence via BITS jobs.
Detects network traffic (DNS, TLS/HTTPS) communicating with the secondary hosting domain 'fileget.loseyourip.com' specifically attempting to retrieve potential payloads mimicking legitimate software (e.g., OBS Studio installer).
This rule detects suspicious activity associated with the Bun runtime after an npm package install. It flags instances where Bun, or download utilities (curl/wget) fetching 'bun.sh', are spawned from Node.js-related processes (npm, node, node-gyp) particularly when located in common temporary or cache directories, indicating potential supply chain compromise or unauthorized runtime deployment during build processes.
This rule detects multi-stage attack patterns indicative of Linux privilege escalation or exploit staging. It tracks the creation of known exploit-related files in temporary directories, the compilation of exploit source code, downloading of scripts from GitHub to temporary directories, and the execution of binaries or commands (e.g., 'unshare', 'tc') often associated with kernel-level exploits. It flags hosts where multiple such indicators are detected sequentially within a single session.
This rule detects anomalous high-volume file download activities from Microsoft SharePoint and OneDrive for Business, which may indicate data exfiltration. The rule aggregates download events by user and IP address over 10-minute intervals and triggers when the download count exceeds 200, excluding known service/backup accounts.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Detects a two-stage attack chain where a host downloads an image file from the network, followed by the execution of suspicious system binaries (e.g., mshta, powershell, rundll32). This pattern is characteristic of steganographic loaders like CloudEyE or DBatLoader used to extract and execute payloads like Remcos RAT.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the Potemkin Loader using the native Windows curl.exe utility to download a ZIP archive from a remote source, followed by the creation of a local .zip file. This behavior is used to bypass security controls by avoiding PowerShell-based download mechanisms.
Detects suspicious PowerShell command lines associated with the TonRAT implant, which is distributed via .lnk shortcut files. The rule identifies obfuscated PowerShell execution spawned by shortcut files, the download of Node.js runtimes from external sources, and the staging of obfuscated JavaScript payloads in temporary directories.
Page 39 of 76