Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,877
5,156
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.
Detects a suspicious sequence of network downloads initiated by bash, sh, or zsh using curl or wget where the command-line includes the 'force=1' parameter. This behavior is indicative of the ClickFix macOS dropper chain often associated with the Macfinger campaign, where multiple payloads (shell scripts and Mach-O binaries) are retrieved from a common C2 infrastructure.
Detects a suspicious sequence of network downloads initiated by bash, sh, or zsh using curl or wget where the command-line includes the 'force=1' parameter. This behavior is indicative of the ClickFix macOS dropper chain often associated with the Macfinger campaign, where multiple payloads (shell scripts and Mach-O binaries) are retrieved from a common C2 infrastructure.
Detects the execution of PowerShell commands that reference the 'nyx' script from 'raw.githubusercontent.com', combined with common download and execution patterns such as 'Invoke-Expression' or 'Invoke-WebRequest'. This activity is consistent with retrieving and executing remote post-exploitation scripts.
Detects network traffic consistent with the download of XMRig cryptocurrency miner release tarballs from GitHub, typically used in malicious deployment scenarios including automated cron-triggered installations.
Detects the BlueMoon exploit kit's post-exploitation activity, specifically identifying when a Chromium-based browser process (chrome.exe or msedge.exe) initiates command-line tools such as cmd.exe, powershell.exe, or curl.exe to download and execute a secondary payload named 'msgbox.exe' within the user's temporary directory.
Detects the use of PowerShell to download files from Vultr Object Storage, specifically targeting patterns associated with the HEAVYGRAM malware distribution. The rule monitors for PowerShell cradles (WebClient, DownloadFile), archive extraction commands, or the execution of a specific payload name (RuntimeSSH.exe) often linked to the Handala Hack threat activity.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule monitors network connections, file events, and process execution command lines for references to a list of known malicious URLs, including indicators associated with ClearFake, IClickFix, AMOS, Remus, and Mozi botnet payloads.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects DNS lookups and subsequent HTTP requests to known domains associated with the Exvicy pop-under/loader malware. These domains are identified as malicious lures often used to initiate payload downloads.
Detects the ClickFix social-engineering pattern where a user is tricked into pasting and executing a command, typically via the Windows Run dialog (explorer.exe), that triggers the command shell (cmd.exe or powershell.exe) to utilize finger.exe or curl.exe for downloading and staging malicious payloads like CastleRAT.
Detects the execution of curl.exe by various script interpreters (cmd.exe, powershell.exe, wscript.exe, mshta.exe) or Windows Explorer. This pattern is commonly used by adversaries to download malicious payloads or intermediate loaders as part of an attack chain, such as deploying CastleLoader/CastleRAT.
Detects high-volume cloud storage access or download activity originating from the python-httpx library within a short window (2 hours). This behavior is often indicative of automated data scraping, exfiltration, or bulk content synchronization.
Detects high-volume, sustained or burst-like access, download, or deletion activity by a single user across SharePoint, OneDrive, or Exchange services. This behavior is indicative of potential data staging, exfiltration, or bulk malicious activity by a compromised account or insider.
Detects a multi-stage PowerShell execution pattern often associated with 'ClickFix' or similar social engineering lures, where a base64-encoded or obfuscated command is used to invoke malicious network downloads (IEX, WebClient, DownloadString). The rule further correlates these execution patterns with potential persistence mechanisms, specifically monitoring modifications to Windows startup locations or Run keys.
Detects a suspicious multi-stage PowerShell execution pattern where an initial process utilizing obfuscated arguments (e.g., -EncodedCommand) launches a secondary PowerShell process that performs network operations indicative of downloading and executing a remote payload.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects npm packages exhibiting suspicious metadata characteristics, such as disproportionately high download counts relative to package age, or combinations of trust signals that suggest potential supply chain poisoning or typosquatting, specifically targeting packages mimicking legitimate sorted-btree functionality.
Page 25 of 76