Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects HTTP GET requests to a specific IP address (62.60.226.185) attempting to download a file named 't0907.exe'. This pattern is associated with the delivery phase of the 2CLoader malware.
This rule detects potentially malicious command execution patterns in Linux environments, specifically targeting Node.js processes performing in-memory evaluation of code (often associated with fileless loaders) or the downloading of files with the .enc extension using common utilities like curl or wget, which may indicate C2 payload retrieval.
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
Detects the abuse of the Windows Background Intelligent Transfer Service (BITS) via the bitsadmin command-line tool or PowerShell's Start-BitsTransfer to download files (such as .exe, .dll, or .ps1) or facilitate potential persistence. Adversaries use these methods to transfer malicious payloads stealthily in the background or to maintain persistence on a compromised host.
This rule detects HTTP GET requests to known malicious domains or URI patterns associated with fake video-conferencing lures. These lures redirect users to download RMM (Remote Monitoring and Management) MSI installers, often masquerading as legitimate software like Adobe Reader or video conferencing tools, as part of a social engineering campaign for initial access.
The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery.
These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR.
This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.
If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR.
This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.
If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
This rule detects PowerShell processes initiated with command-line arguments that indicate obfuscation (e.g., -enc, -encodedCommand) or attempts to download or execute external content (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is commonly observed during the initial execution of malicious payloads or tool delivery.
Detects HTTP GET requests to external servers for files identified as 'mscopilot.exe' or '65722.txt', which are associated with the AdaptixC2 framework/malware, indicating potential payload delivery or command and control activity.
This rule detects potential ClickFix/InstallFix attacks where a user is socially engineered to copy and paste a malicious command from a website that mimics a legitimate developer tool installation (e.g., Claude Code, NotebookLM). The detection flags the use of common download-and-execute cmdlets (e.g., irm, iwr, iex) within common Windows shell interpreters while excluding known legitimate vendor install domains.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs or perform encoding/decoding operations in suspicious directories (Temp, AppData). This activity is commonly used by adversaries for stage-one malware delivery or tool ingress.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects potential malicious activity where a file (in this case, a PDF) is downloaded using curl via conhost, followed shortly by a PowerShell command that searches the file for a specific marker ("cAB") and decodes/executes embedded Base64 content. This pattern aligns with known TTPs observed in Star Blizzard (COLDRIVER) campaigns.
Page 7 of 76