Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,877
5,156
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects npm or node processes spawning shell interpreters (cmd.exe, powershell.exe) during package installation, which subsequently execute download utilities (curl, wget, certutil, bitsadmin). This behavior is characteristic of malicious npm packages attempting to stage payloads during the 'preinstall' or 'postinstall' hooks.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
This rule detects suspicious activity involving the BITSAdmin (bitsadmin.exe) utility, which is a known LOLBin (Living Off the Land Binary). It monitors for the creation of BITS jobs using suspicious flags (e.g., /transfer, /setnotifycmdline) potentially indicating external file downloads, as well as the execution of known command interpreters or utilities spawned as child processes by BITSAdmin, which is a common post-exploitation technique for persistence or secondary payload execution.
This rule detects processes making a high volume of network connections (10 or more within an hour) to URLs containing 'release' or 'download'. This behavior can be indicative of malware downloading additional components, updates, or exfiltrating data, but could also be legitimate software updates or large file transfers.
Detects the use of the BITSAdmin utility to transfer files or set notification command lines. BITSAdmin is a legitimate Windows utility often abused by adversaries to download malicious files or achieve persistence/execution via BITS jobs.
Detects the use of bitsadmin.exe to initiate file transfers from remote HTTP/HTTPS locations. This behavior is frequently used by adversaries to download malicious payloads onto a host using legitimate system utilities.
Detects the AMOS (Atomic macOS Stealer) infection chain where a shell (e.g., Terminal, bash) executes curl to download a DMG file to a temporary directory, followed immediately by the use of hdiutil with the -nobrowse flag to mount the disk image silently, effectively bypassing macOS Gatekeeper UI prompts to the user.
Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
Detects a browser creating a ZIP archive whose name impersonates a GPU, disk, temperature, codec, or PDF utility associated with high-performance systems. This activity is often associated with poisoned search results leading to cryptojacking campaigns.
Detects network activity associated with the Turla group's STOCKSTAY malware infrastructure. This includes downloading MSI installers or server scripts from GitHub, as well as WebSocket C2 communications with the onrender.com platform.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.
Detects a multi-stage attack chain where a system downloads a Python embeddable package via curl, renames the 'pythonw.exe' executable to an arbitrary name, and subsequently executes this renamed binary or a file containing 'config.cat', which is often indicative of automated malware deployment or persistence mechanisms.
Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the unauthorized installation and execution of cloudflared (a Cloudflare Tunnel binary). This rule monitors for PowerShell-based downloading of the binary, silent installation via msiexec, service installation commands, and cloudflared execution from unexpected parent processes, which are patterns often associated with adversary lateral movement or establishing persistence.
Detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, brave.exe, opera.exe) initiate command-line utilities (cmd.exe, powershell.exe, wscript.exe) that include arguments indicative of downloading remote resources (curl, iwr, Invoke-WebRequest, bitsadmin, certutil). This pattern is frequently used to download and execute second-stage malicious payloads.
Detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, brave.exe, opera.exe) initiate command-line utilities (cmd.exe, powershell.exe, wscript.exe) that include arguments indicative of downloading remote resources (curl, iwr, Invoke-WebRequest, bitsadmin, certutil). This pattern is frequently used to download and execute second-stage malicious payloads.
Page 42 of 76