Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,876
5,155
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the Sauron Loader malware pattern where a payload is downloaded or retrieved and written to a randomly named file within a temporary directory, followed by the immediate execution of that staged file. This behavior is indicative of C2 tasking involving payload staging.
Detects a Bash stager script associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The script performs system architecture verification to download a specific Mach-O payload, makes the downloaded file executable using chmod, and subsequently executes the payload.
Detects the execution of PowerShell commands that utilize a combination of 'iex' (Invoke-Expression) and obfuscated strings typical of download cradles. The rule looks for escaped double quotes inside the command line and specific regex patterns that match common obfuscation techniques used to hide malicious URLs or script components.
Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
This rule detects the use of PowerShell to download a specific payload associated with the RustyShade malware from a Backblaze B2 cloud storage bucket. It monitors command lines containing 'wget' or 'Invoke-WebRequest' targeting 'f005.backblazeb2.com' and files named 'DriverInstaller.zip'.
This rule detects PowerShell processes executing with hidden window styles while performing web-based download operations from GitHub domains. It further identifies potential nested PowerShell execution, which is often used in obfuscated download-and-execute attack chains.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects a specific pattern associated with the VioletRAT stage-2 loader, where cmd.exe executes a randomly-named batch file from a temporary directory, which subsequently launches a hidden PowerShell process designed to download or reflectively load a .NET assembly.
Detects a specific pattern associated with the VioletRAT stage-2 loader, where cmd.exe executes a randomly-named batch file from a temporary directory, which subsequently launches a hidden PowerShell process designed to download or reflectively load a .NET assembly.
Detects a specific pattern associated with the VioletRAT stage-2 loader, where cmd.exe executes a randomly-named batch file from a temporary directory, which subsequently launches a hidden PowerShell process designed to download or reflectively load a .NET assembly.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects execution of PowerShell with bypassed execution policy used to download or copy files from remote locations using curl.exe and Copy-Item. This pattern is commonly associated with file staging or retrieving malicious payloads from external URLs, including specific paths.
This rule detects suspicious PowerShell activity including the use of PowerShell to invoke 'curl.exe' for data transfer or the creation of randomly named executables (6-10 characters) within the 'AppData\Local\Temp' directory, which is a common indicator of file staging or malware execution.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects high-volume file access or download activity by a single user in SharePoint or OneDrive over a 15-minute window. This behavior is indicative of bulk cloud data exfiltration often associated with extortion campaigns.
Page 21 of 76