Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.
This rule detects the delivery of potentially malicious Microsoft Office startup files (Excel, Word, PowerPoint macro-enabled or binary files) via HTTP. It specifically looks for files with extensions like .xlsb, .xlsm, .docm, .pptm, or .dotm in the HTTP URI and checks for the presence of "vbaProject" content within the file data, indicating the presence of VBA macros which are often used in malicious documents.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
Bun Runtime Remote Download
Cortex XDR
Detects network connections downloading the Bun runtime from the oven-sh GitHub repository, a behavior exhibited by the Hades loader. This rule specifically looks for HTTP network events where the URL contains 'github.com' and 'oven-sh/bun/releases/download', indicating an attempt to download the Bun runtime.
This rule detects the delivery of an AppleScript payload over HTTP. It specifically looks for HTTP responses (flow:to_client) that contain the string ".scpt" (case-insensitive) in the HTTP URI. This indicates a potential malicious script being downloaded to a client system, often used for execution on macOS systems.
This rule detects patterns indicative of a USB autorun payload download. Specifically, it looks for HTTP traffic (flow:to_client,established) containing the strings "[autorun]" and "open=" (case-insensitive) within the file data. This combination suggests a client is receiving a file that attempts to leverage the autorun feature, often used by malware for initial execution from removable media.
This rule detects the download of common remote access tools (AnyDesk, TeamViewer, RustDesk, Zoho, Atera, UltraViewer) over HTTP. The detection is triggered when an HTTP response flows to the client, is established, contains a URI, and the URI matches one of the specified tool names using a case-insensitive PCRE. Additionally, the response body size must be greater than 100,000 bytes, indicating a potential executable or installer download. This activity is classified as trojan activity and is associated with the MITRE ATT&CK technique T1566.004 (Phishing: Voice Phishing) and tactic Initial Access, suggesting that the download might occur after a voice phishing call.
Detects network connections from PowerShell or script interpreters to specific Cloudflare Workers or R2 infrastructure observed hosting steganographic payloads, associated with the 'Evil MSI Background campaign'. This rule identifies attempts to download malicious content from known adversary-controlled Cloudflare resources.
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
This rule detects HTTP responses containing SVG (Scalable Vector Graphics) content that also embeds base64 encoded data starting with 'TVQAA'. This specific sequence ('TVQAA') is characteristic of a base64 encoded Windows executable (MZ header). The rule aims to identify a technique known as SVG smuggling, where malicious executables are hidden within SVG files and delivered to clients, often as a defense evasion tactic.
This rule detects the delivery of a CMSTP INF file over HTTP that contains specific content indicative of a User Account Control (UAC) bypass attempt. It looks for HTTP responses containing a URI with ".inf", and within the file data, the strings "[DefaultInstall]" and "RegisterOCXs". This combination suggests an attempt to leverage CMSTP (Connection Manager Profile Installer) to execute arbitrary code, often used by adversaries for defense evasion and privilege escalation.
Detects Python or curl downloading payloads from the PySoxy staging IP 206.206.103.106. This indicates potential ingress tool transfer or staging activity by an adversary.
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
This rule detects the delivery of a Linux ptrace injection tool via HTTP. It specifically looks for the string "ptrace(PTRACE_ATTACH" within HTTP response data, indicating that a file containing this specific ptrace function call is being sent to a client. This technique is often used for process injection and privilege escalation on Linux systems.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
This rule detects the deployment of a macOS Launch Agent Property List (plist) file via HTTP. It specifically looks for HTTP responses (flow:to_client) containing both ".plist" in the URI and "LaunchAgent" within the file data, indicating a potential persistence mechanism being established on a macOS system.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
This rule detects the download of AutoHotKey (AHK) or AutoIt (AU3) script files over HTTP. These script files are often used for automation but can also be leveraged by attackers for malicious purposes, such as executing arbitrary code, keylogging, or other forms of automation in an attack chain. The rule specifically looks for HTTP responses where the URI contains file extensions '.ahk' or '.au3'.
Curl Download From Telegram Channel
Cortex XDR
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects users clicking malicious links that result in malware payload downloads
Page 53 of 76