Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,440
11,814
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects suspicious PowerShell commands that utilize the Net.WebClient object to download files or strings from the internet. This is a common technique used by adversaries for ingress tool transfer or to execute malicious code.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Detects the execution of common browser processes (Brave, Chrome, Edge, Opera, Vivaldi) with a command-line argument containing a URL that points to a file with a potentially interesting extension. This behavior can be abused by adversaries to download arbitrary files, potentially for further execution or to hide malicious activity by launching the browser in a minimized state.
This rule detects the execution of 'curl.exe' to download files from a direct IP address, rather than a domain name. It specifically looks for command-line arguments that indicate a download operation (e.g., '-O', '--remote-name', '--output') and the presence of an IP address in the URL. The rule also filters for common executable and script file extensions, suggesting the download of malicious payloads. This activity is often associated with adversaries attempting to retrieve tools or malware onto a compromised system, bypassing typical domain-based reputation checks.
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
Detects new BITS transfer job saving local files with potential suspicious extensions
Page 76 of 76