Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects attempts to download known malicious NPM packages from the public npm registry (registry.npmjs.org) by monitoring network connection logs. It specifically looks for tarball (.tgz) downloads of packages and versions that have been identified as compromised or malicious. The rule extracts the package name and version from the download URL and compares it against a predefined list of malicious packages for high-fidelity detection.
This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms. The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow. Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
The analytic detects the use of msiexec.exe with an HTTP or HTTPS URL in the command line, indicating a remote file download attempt. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as it may indicate an attempt to download and execute potentially malicious software from a remote server. If confirmed malicious, this could lead to unauthorized code execution, system compromise, or further malware deployment within the network.
The analytic detects the use of `certutil.exe` to download files using the `-URL`, `-urlcache` or '-verifyctl' arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` is a legitimate tool often abused by attackers to download and execute malicious payloads. If confirmed malicious, this could allow an attacker to download and execute arbitrary files, potentially leading to code execution, data exfiltration, or further compromise of the system.
Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.
This rule detects a suspicious file download from a known web server or SQL related process which has been identified in the GhostRedirector campaign.
Detects the execution of "findstr" with specific command-line flags and a remote share path. This combination of flags allows "findstr" to download the content of a file located on a remote share, as described in the LOLBAS project. This technique can be used for ingress tool transfer or data staging.
The analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation. If confirmed malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network.
This rule detects the use of the `curl` command-line tool to download a file from a remote HTTP/HTTPS source and immediately execute it. The detection logic specifically looks for `curl` in the command line, followed by an HTTP/HTTPS URL, the `-o` (output file) flag, and an `&` character, which often indicates command chaining for immediate execution. This behavior is commonly observed in adversaries attempting to transfer and execute malicious payloads.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
This rule detects suspicious command-line activity, specifically file downloads using 'curl' initiated by a web browser. This behavior may indicate malicious JavaScript or HTML triggering command execution, a user being tricked into clicking a link that launches a command, or initial access/payload download in a phishing or drive-by attack.
This rule identifies file download events initiated by common web browsers such as Microsoft Edge, Internet Explorer, Google Chrome, and Mozilla Firefox. It can be used for hunting suspicious file downloads on devices, especially after an incident alert, or for general threat hunting.
Identifies Ingress Tool Transfer's.
This query uses MOTW to identify users who have downloaded files from a URI that contains an IP (eg ; https://1.1.1.1/somefile.iso)
Should always be suspicious! Tweak the extensions if you have other extensions in mind.
Should always be suspicious! Tweak the extensions if you have other extensions in mind.
This query searches for users who received a download link via a chat in MS teams or zoom and have clicked the link. (this query looks for a browser invoke to confirm)
This rule breaks Safelinks and extract the URL, and looks for suspicious extensions that are typically malicious
This rule breaks Safelinks and extract the URL, and looks for suspicious extensions that are typically malicious
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
Detects instances where PowerShell is used to download content from external domains using common web request methods (Invoke-WebRequest, iwr, wget, DownloadFile, DownloadString). This behavior is frequently observed during the initial stages of malware delivery, including payload staging or C2 beaconing. The rule excludes known benign sources like slackb.com/error and chocolatey and filters out system-level accounts to reduce false positives.
This detection identifies suspicious use of the Windows RunMRU registry key — typically used by Explorer to store command history — to execute .msi installer files. It specifically flags cases where a registry value under the RunMRU key contains a reference to a .msi file, which can indicate abuse by malware droppers such as LegionLoader.
This detection monitors the execution of 7zG.exe—the 7-Zip GUI executable—specifically when launched from the Traiolx Custom Utils or Kilo Verfair Tools directory under the user’s Roaming profile (\\AppData\\Roaming\\Traiolx Custom Utils). It identifies suspicious command-line activity where 7zG.exe is used to decrypt or extract a file named drata.dat, used to load second payload.
Detects the use of curl to silently download a file from a remote server, often initiated by a command-line interpreter. This technique is used by adversaries, such as in the Epsilon Red ransomware campaign, to fetch payloads without user interaction.
Detects the download of a Java Archive (.jar) file from common file-sharing services like Dropbox or MediaFire. This behavior is associated with sophisticated email campaigns where attackers use PDF attachments with embedded links to trick users into downloading and executing Remote Access Trojans (RATs).
Page 67 of 76