Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
141 detections
Filters
Last updated
All Time
Detection languages
53
43
14
13
8
Contributors
34
28
16
10
8
Categories
102
100
43
23
13
Platforms
141
4
1
1
Products / Services
46
40
29
10
10
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects usage of the Windows certutil.exe utility with flags commonly associated with malicious activity, including downloading files from remote URLs or decoding/encoding files within temporary or application data directories.
Detects the abuse of the legitimate Windows utility certutil.exe to download files or perform encoding/decoding operations. These techniques are commonly used by attackers to stage malicious payloads, obfuscate files to bypass security controls, or retrieve additional malware components in multi-stage loader chains.
Detects the abuse of the legitimate Windows utility certutil.exe to download files or perform encoding/decoding operations. These techniques are commonly used by attackers to stage malicious payloads, obfuscate files to bypass security controls, or retrieve additional malware components in multi-stage loader chains.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects execution of Certutil.exe with arguments commonly used by adversaries for downloading files (urlcache) or decoding malicious payloads (decode/decodehex). These techniques are frequently used to bypass security controls and facilitate the delivery of secondary payloads or tools.
Detects the execution of batch scripts that invoke file transfer utilities (certutil, bitsadmin, or powershell) to download components into temporary directories, a behavior associated with the Red Lamassu campaign.
Detects usage of the Windows certutil.exe utility with flags commonly associated with malicious activity, including downloading files from remote URLs or decoding/encoding files within temporary or application data directories.
Detects usage of the Windows certutil.exe binary to perform potentially malicious operations such as downloading files via URL cache or decoding base64/hex payloads. The rule specifically alerts when these actions occur within common user-writable or temporary directories often used by threat actors for file staging.
Detects the use of certutil.exe to download files from a remote URL using the -urlcache or -split flags. This behavior is a common Living-off-the-Land (LotL) technique used by adversaries to bypass security controls and download secondary payloads.
Detects common shell and utility processes spawning as children of the AutoGen Studio process, indicating potential remote code execution via the AutoJack exploit chain.
Detects execution of Certutil.exe with arguments commonly used by adversaries for downloading files (urlcache) or decoding malicious payloads (decode/decodehex). These techniques are frequently used to bypass security controls and facilitate the delivery of secondary payloads or tools.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects AutoGen Studio spawning Living-off-the-Land binaries (LOLBins) used for execution or payload retrieval. This rule specifically looks for processes initiated by 'autogenstudio' that then execute 'certutil.exe', 'mshta.exe', 'regsvr32.exe', or 'rundll32.exe'.
Detects usage of the built-in Windows utility 'certutil.exe' with parameters commonly used to download files from remote URLs, such as '-urlcache' or '-verifyctl'. This behavior is frequently exploited by adversaries to perform ingress tool transfer and fetch malicious payloads.
Detects usage of the built-in Windows utility 'certutil.exe' with parameters commonly used to download files from remote URLs, such as '-urlcache' or '-verifyctl'. This behavior is frequently exploited by adversaries to perform ingress tool transfer and fetch malicious payloads.
Detects usage of the Windows certutil.exe binary to perform potentially malicious operations such as downloading files via URL cache or decoding base64/hex payloads. The rule specifically alerts when these actions occur within common user-writable or temporary directories often used by threat actors for file staging.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Detects the execution of certutil.exe with command-line flag that can be used to interact with Active Directory Certificate Services, potentially for malicious purposes such as certificate theft or abuse.
Detects the execution of certutil.exe with command-line flag. that can be used to interact with Active Directory Certificate Services, potentially for malicious purposes such as certificate theft or abuse.
Page 2 of 7