Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects usage of the built-in Windows utility 'certutil.exe' with parameters commonly used to download files from remote URLs, such as '-urlcache' or '-verifyctl'. This behavior is frequently exploited by adversaries to perform ingress tool transfer and fetch malicious payloads.
Detects the use of bitsadmin.exe to initiate file transfers, downloads, or file additions using HTTP protocols. This utility is frequently abused by adversaries for Ingress Tool Transfer by downloading malicious payloads from remote systems.
Detects usage of the built-in Windows utility 'certutil.exe' with parameters commonly used to download files from remote URLs, such as '-urlcache' or '-verifyctl'. This behavior is frequently exploited by adversaries to perform ingress tool transfer and fetch malicious payloads.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects the use of the built-in Windows utility 'certutil.exe' with arguments commonly used to download remote content (-urlcache -split -f) or decode base64 encoded files (-decode, -decodehex), when the output or operation occurs within temporary system directories such as Temp, AppData, or ProgramData, and the process is not signed by Microsoft.
Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects the creation of files with suspicious names (e.g., .xlamb, lambsys) in the /var/tmp directory, initiated by common command-line interpreters or network transfer utilities. This behavior is often indicative of malware deployment or staging in a Linux environment.
Detects instances where Python-based applications or web frameworks (uvicorn, gunicorn, langflow) initiate external network requests using 'curl' or 'wget' to download files. The rule specifically looks for command-line arguments involving IP-based URLs and indicators of script execution, shell access, or known cryptocurrency miners.
Detects a script or document containing PowerShell commands for web retrieval (Invoke-WebRequest or DownloadString) that specifically targets an .rtf file from a URL. This pattern is indicative of a staging mechanism for malware like Animateclipper.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Correlates an MSI downloaded by a browser with silent msiexec execution on the same device within fifteen minutes. This rule detects potential malicious software installation initiated by a user downloading an MSI package via a web browser, followed by a silent execution of that package using msiexec.exe. This technique is often used by attackers to install malware without user interaction.
Detects usage of bitsadmin downloading a file from a suspicious domain
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects usage of the Windows certutil.exe binary to perform potentially malicious operations such as downloading files via URL cache or decoding base64/hex payloads. The rule specifically alerts when these actions occur within common user-writable or temporary directories often used by threat actors for file staging.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects a shell script containing 'fanout' in its name, created or modified in common temporary directories like /tmp or /var/tmp, matching a reported propagation workflow. This activity is indicative of lateral movement attempts.
Page 74 of 121