Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the creation of Virtual Hard Disk (.vhd or .vhdx) files by common browser processes. This activity can be indicative of malware delivery, as adversaries may use VHD files to encapsulate payloads and bypass security controls, particularly Mark-of-the-Web (MOTW) protections.
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
Detects the execution of 'IEExec.exe' with command-line arguments containing 'http://' or 'https://', indicating an attempt to download and execute files from a remote web server. This utility is part of the .NET Framework and can be abused by adversaries for ingress tool transfer.
Detects the use of 'curl.exe' to download files by looking for specific command-line arguments such as '-O', '--remote-name', or '--output'. This activity can indicate an adversary transferring tools or other files into a compromised environment.
Detects the download of a file with a potentially suspicious extension from a .zip top-level domain. This rule specifically looks for the creation of alternate data streams (ADS) containing a 'Zone.Identifier' indicating a download from a '.zip' TLD, combined with suspicious file extensions commonly used for malicious payloads.
Detects the use of the .NET utility InstallUtil.exe to download files from remote HTTP or FTP sources. This technique is often used by adversaries to bypass application control and execute malicious code by leveraging a trusted, signed Microsoft binary.
This rule detects the potential for arbitrary file downloads initiated by Microsoft Office applications (Excel, PowerPoint, Word). It specifically looks for instances where these applications are executed and their command line arguments contain HTTP or HTTPS URLs, indicating an attempt to download content from the internet. This behavior can be abused by adversaries to fetch malicious payloads.
Detects usage of the "type" command to download/upload data from WebDAV server. This technique can be used by adversaries to transfer files into or out of a compromised environment.
Detects the execution of "ConfigSecurityPolicy.EXE" with command-line arguments containing URLs (ftp://, http://, https://). This Windows Defender binary can be abused by attackers to download or upload files, potentially leading to arbitrary file download or data exfiltration.
Detects suspicious execution of the Microsoft desktopimgdownldr utility. This utility is being used with parameters to download files from the Internet, specifically when the '/lockscreenurl:' argument is present and the downloaded file is not a common image format (like .jpg, .jpeg, or .png), or when it's used in conjunction with 'reg delete' and '\PersonalizationCSP' to potentially manipulate system settings related to personalization. This behavior can indicate an adversary attempting to download malicious payloads or modify system configurations.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects when the CertOC.exe utility is used to download a file from a remote HTTP source. This behavior is indicative of an adversary using a living-off-the-land binary (LOLBIN) for ingress tool transfer.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') in conjunction with an 'http' string in the command line, indicating an attempt to download files from a remote HTTP source. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects the use of 'PresentationHost.exe', a utility designed to run '.xbap' (Browser Applications) files, when it attempts to download arbitrary files from HTTP, HTTPS, or FTP sources. This behavior can be abused for defense evasion and execution of malicious content.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
Detects the use of bitsadmin.exe to download a file from a direct IP address. This technique is often used by adversaries for ingress tool transfer or to establish persistence by downloading malicious payloads directly from an IP address, bypassing typical domain-based filtering or logging.
This rule detects the use of "ProtocolHandler.exe" to download files from the internet. "ProtocolHandler.exe" is a legitimate Windows binary that can be abused to download files, often placing them in the Internet Explorer cache folder. The detection specifically looks for the execution of "ProtocolHandler.exe" combined with command-line arguments containing common internet protocols like 'ftp://', 'http://', or 'https://'. This behavior is indicative of System Binary Proxy Execution (T1218) where a trusted binary is used to perform malicious actions, potentially bypassing security controls.
Detects the use of bitsadmin.exe to download files into suspicious or commonly abused folders such as temporary directories, program data, or user public folders. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from direct IP addresses. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads, bypassing traditional web proxies or security controls that might monitor domain-based traffic.
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
Detects suspicious file downloads directly from IP addresses using Wget.exe. This rule looks for executions of wget.exe where the command line contains an IP address, 'http', an output flag like '-O' or '--output-document', and a suspicious file extension. This behavior is often associated with adversaries transferring tools or malware onto a compromised system.
Page 75 of 76