Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects instances where 'curl.exe' is used to download content related to Node.js, specifically looking for 'nodejs.org' or 'node-v' in the command line. This could indicate an adversary attempting to download and execute a Node.js runtime or related tools on a compromised system.
Detects PowerShell utilizing the Start-BitsTransfer cmdlet to download the 'syncobs.exe' payload, a known indicator for the PHANTOMPULL loader stage in the REF6598 campaign (PHANTOMPULSE RAT).
Detects cmd.exe spawning PowerShell to download a file using System.Net.WebClient to the Windows Temp directory. This pattern was observed in the DAEMON Tools supply chain attack to drop secondary payloads.
This rule detects common PowerShell patterns used for downloading content from the internet and then executing it. It looks for a combination of download-related commands/objects (e.g., DownloadString, Invoke-WebRequest, Net.WebClient) and execution-related commands/objects (e.g., IEX, Invoke-Expression, Invoke-Command, ScriptBlock) within PowerShell command-line activity. This behavior is frequently observed in malware and adversary tradecraft for initial access, execution, and persistence.
Detects the use of bitsadmin.exe to download a file with a foreground priority. This specific command line structure is used by the CloudZ RAT as a fallback payload download mechanism when curl and PowerShell Invoke-WebRequest fail.
This rule detects the execution of a process on a Linux system where the command line contains a specific URL associated with the 'Copy Fail Exploit Download' (CVE-2026-31431). This indicates an attempt to download or execute a known exploit.
Detects the download of the public proof-of-concept exploit script for CVE-2026-31431 (CopyFail) from the known payload domain 'copy.fail'. Attackers or testers may use utilities like curl or wget to retrieve the payload directly to a vulnerable system.
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Detects the use of the curl utility to download files from bashupload.app, an anonymous file-sharing service. This behavior was observed in Tropic Trooper campaigns to stage payloads and tools during post-exploitation.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
Detects network requests to known malicious domains associated with the fake RedAlert Android malware campaign used by pro-Iranian actors, acting as a payload host or C2 endpoint.
Detects suspicious execution of `wget` or `curl` attempting to retrieve a payload named exactly `/.shell`. This activity is indicative of the Masjesu botnet's C2 download pattern, where it attempts to download a bash shell file after exploiting a target to initiate device infection and propagation routines.
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
Detects suspicious execution of wget or curl retrieving a payload named exactly '/.shell', which matches Masjesu's C2 download pattern. After successfully exploiting a target, the botnet attempts to retrieve this bash shell file to initiate device infection and propagation routines.
This rule alerts when Cato's inline Anti Malware engine identifies a file in transit as malicious. It fires on both blocked and allowed malware to catch cases where the engine detects but fails to block, indicating a potential compromise or a misconfiguration requiring immediate investigation.
Detects the use of PowerShell's BitsTransfer module to download a payload named "syncobs.exe". This specific file and behavior are associated with the REF6598 campaign, where it is used as a secondary staging mechanism to deliver the PhantomPull in-memory loader and ultimately the PhantomPulse RAT.
Detects the secondary staging mechanism used by the intermediate PowerShell script before the PhantomPull in-memory loader is executed. This rule specifically looks for PowerShell or PowerShell Core processes executing commands that utilize `Start-BitsTransfer` to download a file named `syncobs.exe`.
Detects the use of curl to download files from Google Drive directly into the C:\Windows\Temp directory. This behavior was observed in an in-memory loader attack chain deploying ScreenConnect.
Detects a BITS transfer job downloading file(s) from a direct IP address.
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Page 62 of 76