Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects the download of Android Application Package (APK) files from Amazon S3 buckets, where the HTTP URI contains keywords related to gambling (slot, bet, play, jackpot). This activity is indicative of potential malware distribution, specifically targeting Android devices with gambling-themed applications, as observed in Indonesian gambling ecosystems.
Detects a PowerShell process that downloads a ZIP archive and extracts it to the ProgramData directory. This behavior is characteristic of the final stage of the JS#SMUGGLER campaign, which uses this technique to deploy the NetSupport RAT.
KQL Query from file: ConvertMate - suspicious PDF editor
Detects the download of a Java Archive (JAR) file initiated by a PDF reader or web browser, specifically from devices located in Uzbekistan. This behavior is characteristic of the Bloody Wolf threat actor's geofenced attacks.
Detects the download of a Java Archive (JAR) file initiated by a document reader, browser, or email client. This behavior is consistent with the Bloody Wolf threat actor, which uses spear-phishing to trick users into downloading malicious JAR loaders for the NetSupport RAT.
Detects the creation of files with double extensions (e.g., .pdf.rar, .txt.exe), a technique used by the Water Gamayun APT group to disguise malicious payloads.
This rule detects command-line activity indicative of downloading payloads from a Cloudflare Tunnel (`.trycloudflare.com`). This technique is used by the SERPENTINE#CLOUD threat actor to deliver malicious stages of their attack chain. The rule looks for common download utilities or specific WebDAV paths being invoked by command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe.
Detects the execution of a command pattern associated with malicious .lnk files used in the SERPENTINE#CLOUD campaign. The threat actor uses a .lnk file to launch cmd.exe, which then uses robocopy to download a .wsf script from a WebDAV share hosted on a Cloudflare Tunnel, and finally executes it with cscript.exe.
Detects the Kimsuky TTP of using legitimate cloud services like GitHub and Google Drive to download and subsequently execute malicious payloads, often using interpreters like mshta.exe or rundll32.exe.
Detects a PowerShell script that uses Invoke-WebRequest with custom headers to download a file, which is then executed via Start-Process. This technique is used by malware to bypass simple network filtering or for C2 authentication. It was observed in a campaign delivering multiple RAT families including AsyncRAT, DCRAT, and PUREHVNC.
This rule detects network traffic indicative of a Windows Shortcut Link (LNK) file containing an unusually large amount of padded whitespace in its command line arguments. This technique is often used to obfuscate malicious commands or exploit vulnerabilities like ZDI-CAN-25373, which was a zero-day exploit related to Windows shortcuts. The rule specifically looks for the LNK file header signature and then uses a PCRE to identify repeated whitespace characters (tab, newline, vertical tab, form feed, carriage return, space) within the file data, suggesting padding for obfuscation or to bypass security controls.
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
This rule detects the 'Zip Slip' vulnerability pattern within incoming TAR archives. Specifically, it looks for the sequence '|00 00 00 2e 2e 5c|' (which represents '..\') within the file data of a POSIX tar archive. This pattern indicates an attempt to extract files outside of the intended directory, potentially leading to directory traversal and arbitrary file overwrite.
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
Detects the suspicious execution of `certreq.exe` with command-line arguments indicative of downloading a file. This behavior is often abused by attackers to download additional payloads or configuration files from a remote HTTP source. `Certreq.exe` is a legitimate Windows utility for certificate management but can be repurposed for malicious ingress tool transfer.
This rule detects the inbound transfer of a KoiStealer payload over HTTP. It specifically looks for unique string patterns within the HTTP response body that are indicative of the KoiStealer malware, including specific context definitions and keywords like 'CONTEXT_i386', 'CONTEXT_i486', 'CONTEXT_CONTROL', and 'CONTEXT_INTEGER'. This suggests the rule is designed to identify the download of the malware executable or a component of it.
This rule detects attempts to exploit the Zip Slip vulnerability in inbound ZIP archives. It specifically looks for the sequence '../' within the file data of a ZIP archive, which indicates an attempt to write files outside of the intended directory during extraction.
Lumma Stealer Payload Inbound
Suricata
This rule detects the inbound transfer of a Lumma Stealer payload over HTTP. Specifically, it looks for a unique content string within the HTTP response body, indicating the download of a DLL file associated with Lumma Stealer. The content string 'filename="fuckingdllENCR.dll"' is a strong indicator of this specific malware.
This rule detects when a high number of downloads have been performed by a user from SharePoint. This could indicate an insider threat collecting data before sending it outside of the company.
CyberSecurityNews has reported a raising case about a new wave of phishing emails masquerading as breach notifications from LastPass.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
Page 65 of 76