Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,876
5,155
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
This rule detects the execution of a file with an .exe extension from the user's Downloads directory that has been previously tagged with the Mark-of-the-Web (MOTW) Zone.Identifier. It correlates file creation events, the application of the MOTW alternate data stream, and subsequent process execution to identify potentially malicious downloaded executables.
This rule detects the execution of a file with an .exe extension from the user's Downloads directory that has been previously tagged with the Mark-of-the-Web (MOTW) Zone.Identifier. It correlates file creation events, the application of the MOTW alternate data stream, and subsequent process execution to identify potentially malicious downloaded executables.
Detects HTTP GET requests to Cloudflare Pages subdomains (.pages.dev) ending in '/File_download', often used as a distribution point for malicious HTA (HTML Application) or WSF (Windows Script File) payloads in spearphishing campaigns.
This rule detects the Kothamine dropper chain by correlating network connections or command-line activity fetching payloads from a specific GitHub repository ('cphc811-ui/new-tails') with the subsequent creation of associated malicious files (e.g., tailscale-related binaries, injector DLLs) on the same host within a one-hour window.
This rule detects the Kothamine dropper chain by correlating network connections or command-line activity fetching payloads from a specific GitHub repository ('cphc811-ui/new-tails') with the subsequent creation of associated malicious files (e.g., tailscale-related binaries, injector DLLs) on the same host within a one-hour window.
Detects scenarios where common download utilities are used to fetch a file from the internet, followed by the immediate execution or loading of that same file within a 10-minute window, indicative of an Ingress Tool Transfer followed by execution.
Detects the use of legitimate Windows binaries (LOLBins) certutil.exe and bitsadmin.exe for suspicious activities such as downloading files via URL or decoding encoded files. This rule explicitly excludes known legitimate administrative activity originating from Microsoft Configuration Manager (SCCM).
This rule detects the use of native Windows utilities certutil.exe and bitsadmin.exe for potentially malicious purposes. Specifically, it flags certutil.exe being used for decoding or cached URL operations, and bitsadmin.exe being used to initiate file transfers from remote URLs or network paths. These tools are commonly abused by attackers for file staging, ingress tool transfer, and deobfuscation of malicious payloads.
Detects suspicious PowerShell process execution initiated by Windows Explorer, specifically involving WebDAV-related commands or network share mounting indicators. This pattern is commonly associated with attackers attempting to download and execute remote payloads from WebDAV shares to bypass security controls.
Detects execution of package management commands (pip, npm, conda) that attempt to pull packages from registries other than the approved internal repositories. This behavior is indicative of potential AI supply-chain compromise, including malicious packages or namesquatting targeted at machine-learning or LLM-related development workflows.
Detects the creation of files on disk by a browser process where the Zone.Identifier metadata indicates the origin was a blob:, data:, or about:blank URI. This behavior is indicative of HTML smuggling, where malicious payloads are reconstructed client-side from within an HTML document, bypassing network-based security controls.
Detects malicious bash scripts identified as part of the BYOB C2 framework infrastructure. These scripts are designed to download and install second-stage payloads such as Meterpreter or XMRig-style cryptominers. The rule identifies these scripts by their specific naming conventions, embedded C2 infrastructure indicators, and persistence mechanisms including crontab, systemd, and rc.local.
This rule detects the execution of the AnyDesk remote access tool shortly after its likely download via Microsoft Edge. This pattern is commonly associated with social engineering vishing attacks where an adversary directs a user to download and run remote access software.
Detects the use of PowerShell processes that employ command-line encoding (e.g., -enc, -EncodedCommand) in conjunction with download-related cmdlets (e.g., DownloadString, IEX, Invoke-WebRequest), or instances of PowerShell spawned as a child process of another PowerShell process. This pattern is indicative of a loader or stage-one script fetching additional malicious payloads.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Page 14 of 76