Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
'This query looks for new files being downloaded using Curl.'
Query for SmartScreen URL blocks, where the user has decided to run the malware nontheless.
An additional optional filter is applied to query only for cases where Microsoft Edge has downloaded a file shortly after the ignored block.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
An additional optional filter is applied to query only for cases where Microsoft Edge has downloaded a file shortly after the ignored block.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Use this query to locate successful delivery of associated malicious downloads that can lead to ransomware
This query was originally published on Twitter, by @MsftSecIntel.
Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
The query helps find events related to Gootkit downloads and command-and-control behavior.
Reference - https://twitter.com/MsftSecIntel
Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
The query helps find events related to Gootkit downloads and command-and-control behavior.
Reference - https://twitter.com/MsftSecIntel
Endpoint's that downloaded browser extensions
Detects the suspicious execution of `certreq.exe` with specific command-line arguments that indicate an attempt to download files. This technique is documented in LOLBAS (Living Off The Land Binaries and Scripts) as a method for adversaries to transfer files into a compromised environment, bypassing traditional security controls.
This rule detects the execution of the Notepad++ updater utility (GUP.exe) when it is launched by a process other than Notepad++ itself, and is used to download files from the internet. Specifically, it looks for GUP.exe being executed with command-line arguments indicating an unzip operation ('-unzipto') and a URL ('http'), while ensuring the parent process is not Notepad++. This behavior can indicate an adversary abusing a legitimate utility for ingress tool transfer.
This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.
This rule detects the execution of PowerShell commands that utilize the `System.Net.WebClient` object to download files using the `DownloadFile` method. This is a common technique used by adversaries to retrieve malicious payloads or tools from remote servers.
This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.
Detects the use of the Windows Defender command-line utility, MpCmdRun.exe, to download files. This utility is typically used for managing Windows Defender, but adversaries can abuse its 'DownloadFile' function to retrieve arbitrary files from a specified URL, often for staging malicious payloads or tools.
This rule detects the execution of 'nimgrab.exe', a tool associated with the Nim programming framework, which is often used for downloading files. Detection is based on the process name 'nimgrab.exe' or specific file hashes (MD5, SHA256, Imphash) associated with known nimgrab binaries. This tool can be abused by adversaries for ingress tool transfer.
Detects suspicious usage of `curl.exe` on Windows to download files into common temporary or user-controlled directories. This rule specifically looks for `curl.exe` being executed and writing its output to locations like `%appdata%`, `%public%`, `%temp%`, user desktop, or common temporary system directories, often associated with malware staging or persistence. It also identifies downloads of specific file extensions commonly used for malicious payloads.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from known file-sharing or content delivery network (CDN) websites. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects the execution of `certutil.exe` with specific command-line arguments (`urlcache` or `verifyctl`) combined with an HTTP URL, indicating an attempt to download files using this utility. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects suspicious attempts to download files from legitimate Microsoft domains (Outlook and OneNote) using command-line tools or PowerShell. Adversaries may leverage these trusted domains to host malicious files, bypassing traditional perimeter defenses and making the activity appear legitimate. The rule specifically looks for common download utilities like curl, wget, Invoke-WebRequest, and Start-BitsTransfer in conjunction with specific Microsoft attachment/sync domains.
This rule detects when a user, identified as having a high-risk relationship with GCP resources (specifically those containing sensitive data like US Social Security Numbers via GCP DLP context), downloads an executable file. The detection correlates network proxy events showing executable downloads or large file transfers with EDR events indicating Microsoft Excel activity on the same host and by the same user within a 5-minute window. This scenario is indicative of a potential malicious macro in an Excel document downloading and executing malware.
Finds PowerShell execution events that could involve a download.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
Page 71 of 76