Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects execution of Chromium based browser in headless mode
Replace.exe Usage
Sigma
Detects the use of Replace.exe which can be used to replace file with another file
Detects usage of "IMEWDBLD.exe" to download arbitrary files
Detects when a user downloads a file from an IP based URL using CertOC.exe
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Detects the use of 3proxy, a tiny free proxy server
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detects potential RDP connection via Mstsc using a local ".rdp" file
Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet
Detects Pandemic Windows Implant
Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Page 255 of 296