Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
Detects obfuscated PowerShell downloading 'script.ps1' from a suspected CrashFix C2 server (69.67.173.30) by identifying specific obfuscation patterns and download-related keywords in the PowerShell command line.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
Detects the abuse of finger.exe as a download cradle, a technique used by the CrashFix campaign. This involves cmd.exe launching finger.exe (or a renamed copy) to retrieve a payload from a remote server and pipe it directly into cmd.exe for execution.
Detects the download of a file with a double extension (e.g., invoice.pdf.exe). This is a common technique used to disguise malicious files and trick users into executing them.
Detects network traffic indicative of the Diaoyu Loader downloading second-stage payloads from GitHub. The loader masquerades these payloads as image files within a WordPress-like directory structure.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
This query is used to identify the usage of RMM tools.
Detects executable files with names containing PDF-related keywords (e.g., 'pdf', 'convert', 'editor') being dropped in the Downloads folder by a web browser process. This behavior is typical of users downloading potentially unwanted or malicious PDF converters, often delivered via SEO poisoning or malvertising campaigns.
Detects the download of the Amnesia RAT payload from a specific Dropbox URL observed in a multi-stage malware campaign.
Detects PowerShell downloading a batch file (.bat) into the user's Startup folder. This is a common persistence technique (T1547.001) and was observed in an AsyncRAT campaign where the payload was downloaded from a malicious `trycloudflare.com` domain.
Detects the use of PowerShell to download and/or expand a Python environment from the official python.org website. This technique has been observed in AsyncRAT campaigns to stage a legitimate interpreter for executing malicious Python code, bypassing defenses that might block known malicious executables.
Detects a sequence of events associated with the Astaroth banking trojan, where a script downloads a file from a raw GitHub URL, followed by the execution of an AutoIT interpreter. Astaroth is known to use GitHub to host configuration files disguised as images (steganography).
This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events from data mapped to the Elastic Common Schema (ECS).
Detects Windows executable downloads with document or image file extensions, a common malware delivery technique
Detects a ClickFix attack chain involving an email client opening a browser to a suspicious domain, followed by a file download, and subsequent execution via cmd.exe from explorer within a short timeframe. This chain of events is indicative of a social engineering attack designed to trick users into executing malicious files.
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
Page 64 of 76