Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise, where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation. The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
This detection looks at users attempting to download files from the internet using powershell / cmd commands. It measures the number of commands against a baseline set over the past 14days and if a user has performed an unusual amount of commands (also more than 5) then an alert will be created. This will detect when an attacker has compromised a user and is now attempting to download payloads from the internet or a C2.
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms. The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow. Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
The analytic detects the use of `certutil.exe` to download files using the `-URL`, `-urlcache` or '-verifyctl' arguments. This behavior is identified by monitoring command-line executions for these specific arguments via Endpoint Detection and Response (EDR) telemetry. This activity is significant because `certutil.exe` is a legitimate tool often abused by attackers to download and execute malicious payloads. If confirmed malicious, this could allow an attacker to download and execute arbitrary files, potentially leading to code execution, data exfiltration, or further compromise of the system.
Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.
This rule detects a suspicious file download from a known web server or SQL related process which has been identified in the GhostRedirector campaign.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects hard IoCs and activity associated with a trojanized installer of Velociraptor incident response tool making callbacks to C2 domains from workers[.]dev and tunneling with Visual Studio Code (code.exe). The detection looks for the creation of hard IoCs from this malicious Velociraptor installer V2.msi, followed by network connections to known C2 domains and the execution of related processes, including PowerShell (with support for detecting encoded commands to install code.exe) and msiexec activity tied to malicious domains.
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload.
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
This detection identifies suspicious child processes of SpeechRuntime.exe that could indicate abuse of a vulnerability. SpeechRuntime is vulnerable to an attack that allows a user to run code on another user's session remotely and stealthily by exploiting a Windows COM class. When this class is invoked, it launches SpeechRuntime.exe in the context of the currently logged-on user. Because this COM class is susceptible to COM Hijacking, an attacker can alter the registry remotely to point to a malicious DLL. By dropping that DLL on the target system (e.g., via SMB) and triggering the COM object, the attacker causes the malicious DLL to load into SpeechRuntime.exe and execute under the user's context. The rule specifically looks for SpeechRuntime.exe spawning common command and scripting interpreters or tools used for execution and file transfer.
Detects the execution of "findstr" with specific command-line flags and a remote share path. This combination of flags allows "findstr" to download the content of a file located on a remote share, as described in the LOLBAS project. This technique can be used for ingress tool transfer or data staging.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
The analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation. If confirmed malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network.
This rule detects the use of the `curl` command-line tool to download a file from a remote HTTP/HTTPS source and immediately execute it. The detection logic specifically looks for `curl` in the command line, followed by an HTTP/HTTPS URL, the `-o` (output file) flag, and an `&` character, which often indicates command chaining for immediate execution. This behavior is commonly observed in adversaries attempting to transfer and execute malicious payloads.
Detects the use of 'replace.exe' with the '-a' argument, which is used to add new files to the destination directory. This utility can be abused by adversaries to replace or add files on a system, potentially for persistence, defense evasion, or to introduce malicious tools.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Page 102 of 121