Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the execution of the Go-compiled Gentlemen ransomware payload from unusual directories, exhibiting self-propagation mechanisms. This rule specifically looks for executables with a generic name pattern (e.g., 'abc.exe') in common temporary or shared directories (Temp, Downloads, Public, ProgramData) and command-line arguments indicative of propagation, scanning, or encryption activities.
Hunts for curl or wget pulling secondary stage obfuscated payloads from Pastebin or GitHub Gists initiated by developer tools.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects common patterns of post-exploitation activity including downloading scripts (isp.sh) via curl/wget, executing shell commands to fetch remote payloads, running suspicious binaries from temporary directories like /var/tmp or /tmp, and persistent execution patterns.
Detects the use of BITSAdmin to download files from remote URLs. Attackers frequently abuse BITSAdmin, a legitimate Windows administrative tool, to download malicious payloads or secondary tools from external servers.
This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
This rule detects suspicious activity on Linux endpoints related to the execution of files named 'isp.sh' or 'lambsys', as well as potential file downloads from a known malicious IP address. It monitors process creations and file creations involving these specific artifacts, as well as common attack patterns such as piping web-downloaded content directly to a shell.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
Detects suspicious PowerShell processes initiated by common non-terminal applications (e.g., browser, office, script hosts) that perform in-memory code execution (using commands like IEX or System.Reflection) and simultaneously establish rapid network connections to multiple distinct external IP addresses within a one-minute window. This behavior is indicative of a staged payload download or beaconing activity.
Detects the use of bitsadmin.exe to create or modify BITS jobs, which can be leveraged by attackers for file downloads or as a persistence mechanism to execute commands.
Detects the use of bitsadmin.exe to create or modify BITS jobs, which can be leveraged by attackers for file downloads or as a persistence mechanism to execute commands.
Detects the download of a standalone CPython 3.10.18 interpreter from github.com/astral-sh/python-build-standalone using curl, followed by the extraction of the compressed archive using tar. This behavior is associated with the macOS.Gaslight malware's secondary collection module installer, which likely prepares a localized Python environment to execute further malicious tasks.
Detects an AI agent performing outbound network connections to the stitch-design.ai domain. This behavior is indicative of a malicious AI agent attempting to fetch dynamically loaded execution instructions at runtime to evade static analysis during security vetting processes.
Detects the execution of the Windows binary 'certutil.exe' using flags commonly abused by adversaries to download files from remote URLs or decode base64-encoded files. It excludes instances where certutil is executed by Microsoft-signed processes from the System32 directory to reduce false positives.
Detects the use of PowerShell to initiate web requests to Storj-hosted URLs (link.storjshare.io or .storj.io), utilizing either the WebClient class or the Invoke-WebRequest cmdlet. This behavior is associated with the REF8372 OXLOADER malvertising campaign, where PowerShell scripts are used to download malicious payloads.
Detects the use of bitsadmin.exe to initiate file transfers, downloads, or file additions using HTTP protocols. This utility is frequently abused by adversaries for Ingress Tool Transfer by downloading malicious payloads from remote systems.
Page 73 of 121