Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
Detects usage of the "type" command to download/upload data from WebDAV server. This technique can be used by adversaries to transfer files into or out of a compromised environment.
Detects suspicious execution of the Microsoft desktopimgdownldr utility. This utility is being used with parameters to download files from the Internet, specifically when the '/lockscreenurl:' argument is present and the downloaded file is not a common image format (like .jpg, .jpeg, or .png), or when it's used in conjunction with 'reg delete' and '\PersonalizationCSP' to potentially manipulate system settings related to personalization. This behavior can indicate an adversary attempting to download malicious payloads or modify system configurations.
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases. This rule identifies outbound network connections to a specific list of destination ports that have been historically associated with malware command and control (C2) communications. It filters out connections to local IP ranges and common system directories to reduce false positives.
This rule detects outbound network connections to destination ports 8080 or 8888 that are not within common local IP ranges or initiated by programs in standard system directories. This aims to identify potentially malicious command and control (C2) activity or data exfiltration using non-standard ports.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
Detects when the CertOC.exe utility is used to download a file from a remote HTTP source. This behavior is indicative of an adversary using a living-off-the-land binary (LOLBIN) for ingress tool transfer.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') in conjunction with an 'http' string in the command line, indicating an attempt to download files from a remote HTTP source. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects the execution of SharpChisel, a .NET port of the Chisel tunneling tool, by monitoring process creation events for the executable name or product metadata. This tool can be used by adversaries to establish internal proxies for command and control traffic.
This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.
Detects the usage of winget to add new additional download sources. Adversaries may abuse this functionality to introduce malicious package repositories, potentially leading to the download and execution of unauthorized software or tools.
Detects attempts to add an insecure (HTTP) download source to Winget. While Winget is designed to prevent the addition of insecure sources, this activity could indicate an attempt to bypass security controls or a user error. This rule specifically looks for the execution of 'winget.exe' with 'source add' and 'http://' in the command line.
This rule detects the usage of the Windows Package Manager (winget.exe) to install applications via a local manifest file. Adversaries can abuse winget to download and execute various types of payloads (e.g., .exe, .msi, .msix) from remote sources by providing a YAML manifest file directly to the client. This technique can be used for execution and defense evasion.
This rule detects when the `IMEWDBLD.exe` process initiates a network connection. This behavior is suspicious because `IMEWDBLD.exe` is a legitimate Microsoft Windows component (Input Method Editor Word Dictionary Builder) that is not typically expected to make outbound network connections. Adversaries may abuse this utility as a Living Off The Land Binary (LOLBIN) to download additional payloads or exfiltrate data, leveraging its trusted status to evade detection. The detection focuses on the initiation of any network connection by this specific executable.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
Detects the execution of 'GfxDownloadWrapper.exe' with a URL as a command-line argument, indicating an attempt to download a file. This utility is part of Intel Graphics Command Center and can be abused for ingress tool transfer.
Detects the execution of Htran or Htran-like tools such as NATBypass, identified by specific executable names or command-line arguments. These tools are commonly used for proxying network connections to obscure the origin of malicious traffic.
Page 289 of 296