Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects potential RondoDox botnet infection attempts by monitoring for the execution of common command-line tools (wget, busybox, curl) using specific flags (-qO-, -s) to download and pipe remote scripts from the known C2 IP 45.92.1.50 directly into a shell interpreter for execution.
Detects downloads of CVE exploit proof-of-concept code
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet using common command-line tools like cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, or bitsadmin.exe. This behavior can indicate malicious activity, such as malware downloading additional stages or tools.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain.
Detects BITS transfer job downloading files from a file sharing domain.
Detects PowerShell connecting to an IP to download an image file containing embedded Base64 markers (<<BASE64_START>>). This behavior is associated with the Vidar stealer, which uses steganography to hide its payload within image files.
Detects PowerShell using Net.WebClient to download an MSI payload. This technique is often used by adversaries to download and execute malicious installers.
Detects msiexec.exe silently downloading and installing an MSI payload from an external URL. This behavior is often indicative of malicious activity where an attacker uses msiexec to fetch and execute a malicious installer without user interaction.
Detects a recently downloaded utility executable loading autorun.dll from the same writable directory, consistent with DLL side-loading. This behavior is often associated with malware attempting to establish persistence or elevate privileges by abusing legitimate applications.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
Detects downloads of typosquatted packages from npm or PyPI
Detects downloads of typosquatted packages from npm or PyPI
This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.
Detects bulk downloading of SharePoint document libraries
Detects the Dropbox staging URL used to deliver the obfuscated Synaptics archive, specifically looking for network connections to 'dropbox.com' for 'Synaptics.rar' and correlating it with the execution of '._cache_GAME1.exe'. This indicates the download and potential execution of a malicious payload.
Detects secondary payload fetching from the documented malicious domain brightly.to, specifically when initiated by a process named '._cache_GAME1.exe'. This indicates potential malware activity related to malicious Steam Workshop wallpapers.
Detects download of potentially malicious browser extension CRX packages
Detects download of malware samples from sharing platforms
Page 51 of 76