Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.
Detects the use of curl to silently download a file from a remote server, often initiated by a command-line interpreter. This technique is used by adversaries, such as in the Epsilon Red ransomware campaign, to fetch payloads without user interaction.
Detects PowerShell execution using Invoke-WebRequest (or its aliases like curl, wget, Invoke-RestMethod, irm, iwr) to connect to an IP address directly. This behavior can be indicative of malware downloading additional stages or establishing command and control, especially when avoiding DNS resolution.
This rule detects PowerShell scripts that utilize web request cmdlets (Invoke-WebRequest, Invoke-RestMethod, irm, iwr) along with the '-UserAgent' parameter. Adversaries often modify user agents to mimic legitimate traffic or specific applications, blending in with normal network activity to evade detection while communicating with command and control servers or exfiltrating data.
Detects suspicious execution of PowerShell's Invoke-WebRequest cmdlet (or its aliases like curl, iwr, wget) when the output is directed to a suspicious location. Adversaries often use this technique to download malicious tools or files into user-controlled directories like AppData, Desktop, Temp, or Public folders, or directly into the Windows directory, which are not typical locations for legitimate Invoke-WebRequest output.
Detects the use of encoded or obfuscated IP addresses (hex, octal, etc.) within a URL in conjunction with common download commands. This technique is often used by adversaries to evade simple network-based detections or to obscure their infrastructure.
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets. This activity is often associated with adversaries transferring malicious tools or components into a compromised environment.
Catches PowerShell processes with both Base64 decoding and network download capabilities, indicating potential remote payload execution typical of advanced ClickFix attacks.
Detects known samples of the Katz Stealer infostealer based on their SHA1 file hashes.
This detection rule identifies the presence of the SLOW#TEMPEST ISO file based on its SHA256 hash. This ISO file is the initial delivery mechanism for the malware campaign.
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
This analytic detects outbound connections from Cisco Secure Firewall Threat Defense to commonly abused file sharing and pastebin-style hosting domains. It specifically looks for allowed connections where the URL matches a predefined list of known data hosting or temporary storage services. These platforms are frequently used by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. Identifying such connections can indicate potential abuse of legitimate infrastructure as part of an attacker's kill chain, suggesting tool staging, credential dumping, or outbound data leaks over HTTP(S).
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
This rule detects file events where the target object path indicates a WebDAV mount point, specifically looking for paths containing '\Device\Mup\;WebDavRedirector\.*\DavWWWRoot\.*' combined with a domain name or IP address. This pattern is often associated with forced authentication attempts or ingress tool transfer via WebDAV.
Page 104 of 121