Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
51
14
7
5
5
Contributors
29
14
10
6
3
Categories
61
51
32
14
10
Platforms
88
2
2
1
Products / Services
25
19
15
5
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the use of bitsadmin.exe to download a file from a direct IP address. This technique is often used by adversaries for ingress tool transfer or to establish persistence by downloading malicious payloads directly from an IP address, bypassing typical domain-based filtering or logging.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Detects the use of bitsadmin.exe to download files into suspicious or commonly abused folders such as temporary directories, program data, or user public folders. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Page 5 of 5