Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
This rule detects suspicious command-line activity that may indicate the leakage of API keys, specifically those resembling OpenAI API keys (starting with 'sk-', 'sk_live_', or 'sk_test_'). It looks for these patterns in conjunction with common data transfer utilities like curl, wget, powershell, or python, when executed by a process that is not a standard shell or explorer process. The rule triggers if two or more such events occur within an hour on the same computer.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Detects the execution of 'curl' with specific flags ('-kfsSL') often used for silent and insecure file downloads. This pattern has been observed in malware like Amos Stealer to download malicious payloads. The rule looks for 'curl' as the filename or at the beginning of the command line, combined with the specified flags and an HTTP/HTTPS URL.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, commonly used for retrieving multi-stage scripts.
Identifies the fake updater process making network connections to download heavily encrypted payload blobs (often .bin or .dat files) to evade perimeter AV. This rule specifically looks for `curl.exe`, `powershell.exe`, or `certutil.exe` being used to download files with `.bin`, `.dat`, or `.enc` extensions, initiated by a process with 'setup' or 'update' in its filename.
Correlates the exploited Bomgar process utilizing native network utilities (curl, wget, certutil) to download secondary malware stages from the internet.
Detects CI/CD runners utilizing inline base64 decoding to execute malware payloads, specifically looking for processes that use 'base64 -d' in their command line and also initiate network connections to a known malicious IP address (216.126.225.129) while using 'curl' or 'wget'.
This rule detects the execution of 'curl.exe' that initiates a network connection to the domain 'kak.is'. This activity is indicative of the UnregStealer malware attempting to fetch additional components or communicate with its command and control (C2) server.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
Detects bun.exe executing scripts directly from remote URLs, a common fallback behavior for these worms.
Detects a MeshCentral agent launched from temporary directories or Oracle PeopleSoft application paths. This activity is often associated with remote access software used by adversaries.
Detects potential RondoDox botnet infection attempts by monitoring for the execution of common command-line tools (wget, busybox, curl) using specific flags (-qO-, -s) to download and pipe remote scripts from the known C2 IP 45.92.1.50 directly into a shell interpreter for execution.
Detects newly written executables within the per-user ClickOnce cache directory that lack valid digital signatures. This rule specifically looks for file creation events of executable files (.exe) in the `AppData\Local\Apps\2.0\` directory, excluding creations initiated by `msiexec.exe` or `explorer.exe`.
Detects creation, modification, or renaming of 'help.php' within a REDCap application path. This activity is indicative of a web shell deployment, as observed by GTIG with UNC6508 using 'help.php' for persistence and payload uploads. The combination of the campaign-specific filename and REDCap path provides a high-confidence signal.
Detects downloads of CVE exploit proof-of-concept code
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet using common command-line tools like cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, or bitsadmin.exe. This behavior can indicate malicious activity, such as malware downloading additional stages or tools.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
Detects malicious executables dropped to shared network folders
Advanced time-series detection of a single installer process dropping both a known RMM tool artifact and an anomalous executable within 10 seconds.
Page 79 of 121