Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
11
Contributors
6
4
1
Categories
9
2
2
Platforms
11
Products / Services
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects the creation of a named file stream with the imphash of a well-known hack tool
Detects execution of a suspicious payload from common staging locations used in multi stage campaigns.
Detects the download of suspicious file types (executables, DLLs, scripts, etc.) from well-known file and paste sharing domains. The detection specifically looks for the creation of Alternate Data Streams (ADS) with a ':Zone' identifier, which indicates the file was downloaded from the internet and carries Mark-of-the-Web.
Detects the creation of a named file stream with the imphash of a well-known hack tool
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects the download of suspicious file type from a well-known file and paste sharing domain
This rule detects the potential for arbitrary file downloads initiated by Microsoft Office applications (Excel, PowerPoint, Word). It specifically looks for instances where these applications are executed and their command line arguments contain HTTP or HTTPS URLs, indicating an attempt to download content from the internet. This behavior can be abused by adversaries to fetch malicious payloads.
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash