Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, specifically when extracting into `C:\ProgramData` or similar staging locations. This behavior has been observed in recent APT37 activity where a CAB payload was expanded into ProgramData prior to persistence and execution, indicating ingress tool transfer and payload staging.
The following analytic detects the use of PowerShell's download methods such as "DownloadString" and "DownloadData" from the WebClient class or Invoke-WebRequest and its aliases "IWR" or "Curl". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as such methods and functions are commonly used in malicious PowerShell scripts to fetch and execute remote code. If confirmed malicious, this behavior could allow an attacker to download and run arbitrary code, potentially leading to unauthorized access, data exfiltration, or further compromise of the affected system.
The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This rule detects common PowerShell download and execution cradles. It looks for command-line arguments that indicate an attempt to download content from the internet (e.g., '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', 'Invoke-RestMethod', 'irm') combined with immediate execution (e.g., ';iex $', '| IEX', 'Invoke-Expression'). These patterns are frequently used by adversaries to fetch and execute malicious scripts or payloads directly in memory.
The analytic detects the use of Windows Curl.exe to download a file to a suspicious location, such as AppData, ProgramData, or Public directories. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include the -O or --output options. This activity is significant because downloading files to these locations can indicate an attempt to bypass security controls or establish persistence. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further compromise of the system.
Detects suspicious command-line activity spawned by the GoAnywhere MFT Tomcat service. This behavior is indicative of post-exploitation techniques observed following the exploitation of CVE-2025-10035, as detailed by Microsoft Threat Intelligence. The detection looks for specific discovery and execution commands launched via cmd.exe or powershell.exe from the GoAnywhere parent process.
The analytic detects instances where a Dynamic Link Library (DLL) is loaded from a temporary directory on a Windows system. Loading DLLs from non-standard paths such as %TEMP% is uncommon for legitimate applications and is often associated with adversary tradecraft, including DLL search order hijacking, side-loading, or execution of malicious payloads staged in temporary folders. Adversaries frequently leverage these directories because they are writable by standard users and often overlooked by security controls, making them convenient locations to drop and execute malicious files. This behavior may indicate attempts to evade detection, execute unauthorized code, or maintain persistence through hijacked execution flows. Detection of DLL loads from %TEMP% can help surface early signs of compromise and should be investigated in the context of the originating process, user account, and potential file creation or modification activity within the same directory.
Detects PowerShell commands using `curl -o` to download `.dll`, `.pyc`, or other suspicious file extensions to temporary user directories. This technique was observed being used by the Confucius group to download their malware components.
Detects PowerShell execution patterns consistent with the 'FileFix' social engineering technique. This technique tricks users into pasting and running a malicious command, often from the Run dialog or File Explorer address bar, which results in explorer.exe being the parent process. The command typically involves downloading and executing a remote script.
Detects a process execution chain characteristic of the ClickFix technique, where explorer.exe spawns a headless conhost.exe, which in turn leads to the execution of curl.exe to download a payload.
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
This query groups all files by their originating file—such as a ZIP archive or from a Website—and includes all the files that were extracted from it. Among the benefits of Correlating File Events Using InitiatingProcessUniqueId field we can identify:
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
The analytic detects the use of Windows Curl.exe to upload a file to a remote destination. It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs. This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system. Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary.
Detects AdaptixC2 beacon (PE) and shellcode loader components based on unique code patterns and API hashes.
Detects the execution of suspicious file types from a user's 'Music' folder. This is an uncommon behavior used by the CountLoader malware for staging payloads.
Detects the download of suspicious file types (executables, DLLs, scripts, etc.) from well-known file and paste sharing domains. The detection specifically looks for the creation of Alternate Data Streams (ADS) with a ':Zone' identifier, which indicates the file was downloaded from the internet and carries Mark-of-the-Web.
Detects the use of curl.exe to download files from known file-sharing or code-hosting domains. This activity is often associated with adversaries staging or retrieving malicious tools and scripts. The rule specifically looks for curl.exe executing with command-line arguments indicating a download operation ('-O', '--remote-name', '--output') from a list of suspicious domains, and targeting common executable or script file extensions.
Detects the download of suspicious file types (batch, command, PowerShell scripts) from well-known file and paste sharing domains. This rule specifically looks for the creation of Zone.Identifier alternate data streams on these file types, which indicates they were downloaded from the internet.
This rule detects the use of PowerShell (powershell.exe or pwsh.exe) to download files from known file-sharing or content delivery network (CDN) domains. It specifically looks for command-line arguments indicative of file download operations, such as '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', and 'wget'. The rule aims to identify suspicious activity where PowerShell is leveraged to retrieve potentially malicious payloads from untrusted or commonly abused online services.
Detects potentially suspicious file downloads from known file-sharing domains using `wget.exe`. This rule looks for `wget.exe` execution where the command line includes common file-sharing or code-hosting domains, an HTTP/HTTPS URL, and flags indicating an output file (e.g., `-O` or `--output-document`). It also specifically looks for downloads of common executable or script file extensions, such as `.exe`, `.dll`, `.ps1`, `.bat`, `.vbs`, `.hta`, and `.msi`.
Detects the installation and configuration of a TacticalRMM agent where specific command-line flags (--api, --auth, --client-id, --site-id, --agent-type) are used. This indicates the agent is being configured to connect to a particular RMM server with authentication and client/site identification. This activity could signify a threat actor attempting to register the agent with their own controlled RMM infrastructure for persistent remote access.
Page 101 of 121