Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects potential malware execution chains characteristic of AMOS (Atomic macOS Stealer) and related 'ClickFix' campaigns. The rule monitors for the silent downloading of a disk image (.dmg) file to the /tmp directory using curl with quiet flags, followed immediately by the mounting of that image using hdiutil with the -nobrowse flag to bypass user notification and Gatekeeper security prompts.
Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.
Detects the creation of executable files (exe, dll, bat, ps1, vbs, msi, lnk) by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a user downloading or receiving a potentially malicious file, which could lead to initial access or further compromise.
This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.
Detects executable content served with incorrect MIME type for masquerading
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
This rule detects processes launched from common user-writable or temporary directories (Downloads, AppData/Temp, etc.) that initiate a network connection more than 60 seconds after the process start time. This behavior is indicative of a delayed C2 beaconing or a dormant malicious payload being activated.
This rule detects the use of common command-line utilities such as curl, certutil, and PowerShell to download files from a specific external domain ('thomphon.com') or to download a file named 'update.msi'. These activities are often associated with the staging of malicious payloads.
Detects the use of common Windows living-off-the-land binaries (certutil, bitsadmin, curl, powershell) to download external files, which is a common behavior associated with staging malware loaders such as MintsLoader and D3F@ck Loader.
Correlates the recent download of an .rdp file with its execution by mstsc.exe, initiating the outbound connection to the attacker's infrastructure.
Detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, brave.exe, opera.exe) initiate command-line utilities (cmd.exe, powershell.exe, wscript.exe) that include arguments indicative of downloading remote resources (curl, iwr, Invoke-WebRequest, bitsadmin, certutil). This pattern is frequently used to download and execute second-stage malicious payloads.
Detects the execution of 'rundll32' attempting to load 'installer.dll' and invoke its 'Begin' export function. This activity is often associated with malware, specifically the Clickfix campaign, which uses PowerShell's 'Invoke-WebRequest' to download the DLL.
Detects curl.exe downloading payloads to generic .dat or .exe files in AppData, or hitting known staging IPs.
Detects execution of Certutil.exe with arguments commonly used by adversaries for downloading files (urlcache) or decoding malicious payloads (decode/decodehex). These techniques are frequently used to bypass security controls and facilitate the delivery of secondary payloads or tools.
Correlates the user interacting with a browser in kiosk mode (potentially indicating a fake tech support page) and immediately downloading an executable file into the Downloads folder. This behavior is indicative of the Havoc Demon loader being delivered via social engineering tactics.
Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.
Detects the JDY botnet's infection chain on Linux systems, characterized by script-based processor architecture reconnaissance followed by the retrieval, execution, and subsequent deletion of architecture-specific (MIPS) binaries. This rule monitors shell-based command sequences involving system information gathering, network-based file downloads, and immediate removal of the downloaded file.
Detects the execution of PowerShell via Command Prompt (cmd.exe) using hidden window arguments to download files from external sources or temporary directories, often associated with stages of malware delivery or post-exploitation activity.
Page 44 of 76