Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects anomalous HTTP GET requests targeting the ClawHub API for 'skills' that match known patterns of malicious file downloads, specifically identifying poc.py scripts or skill.md files which are indicative of the ClawHavoc campaign activity.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate background data transfer jobs pointing to non-Microsoft or non-Windows Update domains. This technique is commonly used by adversaries for C2 communication or to download malicious payloads.
Detects the creation of potentially malicious archive files (.zip, .iso, .img, .cab) in the Downloads folder, initiated by web browsers (Chrome, Edge, Firefox), where the initiating process's command line indicates a local file access (file:///), suggesting a Blob-to-Disk dropper technique often associated with AI-obfuscated phishing campaigns.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects phishing attempts leveraging legitimate service redirectors such as Calendly and Google share URLs to deliver malicious photo-themed ZIP archives. The rule identifies suspicious redirect chains to Cloudflare-hosted (.cfd) domains and monitors for specific ZIP filename patterns commonly used in these campaigns to target the hospitality sector.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
Detects the use of the BITSAdmin utility to transfer files or set notification command lines. BITSAdmin is a legitimate Windows utility often abused by adversaries to download malicious files or achieve persistence/execution via BITS jobs.
Detects the use of the BITSAdmin utility to transfer files or set notification command lines. BITSAdmin is a legitimate Windows utility often abused by adversaries to download malicious files or achieve persistence/execution via BITS jobs.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfers, specifically targeting non-Microsoft signed processes. Adversaries often abuse the Background Intelligent Transfer Service (BITS) to download malicious payloads or exfiltrate data, as it is a legitimate Windows service that operates in the background.
Tracks network communication matching specific ClickOnce deployment URLs traversing over unencrypted HTTP. This rule identifies attempts to download or access ClickOnce application deployment files (.application) over unencrypted HTTP, which could indicate a potential supply chain attack or malware delivery mechanism.
This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.
Detects malicious payloads downloaded from a spoofed legitimate domain (e.g., downloading "update.exe" from a hijacked google.com). This rule specifically looks for 'google.com/update.exe' or 'microsoft.com/flash_update.exe' within the RemoteUrl field, indicating a potential attempt to deliver malicious software from a compromised or spoofed legitimate domain.
Page 45 of 76