Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects a script or document containing PowerShell commands for web retrieval (Invoke-WebRequest or DownloadString) that specifically targets an .rtf file from a URL. This pattern is indicative of a staging mechanism for malware like Animateclipper.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Detects potential browser fingerprinting and network reconnaissance behavior associated with Bluekit BitM PhaaS campaigns. The rule correlates large suspicious JavaScript file downloads (excluding common CDNs) with STUN server connectivity within a 10-minute window, a pattern often used by adversary-in-the-middle (AiTM) frameworks to fingerprint victims and establish WebRTC channels.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Correlates an MSI downloaded by a browser with silent msiexec execution on the same device within fifteen minutes. This rule detects potential malicious software installation initiated by a user downloading an MSI package via a web browser, followed by a silent execution of that package using msiexec.exe. This technique is often used by attackers to install malware without user interaction.
Detects usage of the Windows certutil.exe binary to perform potentially malicious operations such as downloading files via URL cache or decoding base64/hex payloads. The rule specifically alerts when these actions occur within common user-writable or temporary directories often used by threat actors for file staging.
Parses bitsadmin commands executing arbitrary HTTP requests and dropping .exe or .dll files into system paths.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
Detects a command shell using cURL to download an MSI package and immediately install it silently with msiexec, matching a reported RMM delivery workflow. This rule specifically looks for command-line executions involving 'cmd.exe', 'powershell.exe', or 'pwsh.exe' that use 'curl' to download a '.msi' file and then execute 'msiexec' with silent installation flags.
Correlates the download of a payload using 'curl' to the /tmp/ directory with an immediate 'chmod +x' command on a file in the /tmp/ directory, making it executable. This sequence of events is indicative of preparing a downloaded script or binary for execution, often seen in the initial stages of infostealer attacks on macOS.
Identifies successful device code authentication followed by a high volume of file downloads within a short timeframe, which could indicate data exfiltration after an adversary has gained access through a device code phishing campaign.
Parses BITSAdmin command lines to detect the stealthy download of the secondary loader, specifically looking for arbitrary extensions being renamed to .dll upon completion.
Detects a binary masquerading as an 18-digit executable in LocalAppData executing curl-specific arguments (-s -L -o) to download a .pdf file (actually the Python RAT archive).
Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.
Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).
Page 48 of 76