Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects execution of the IEExec utility to download and execute files
Detects when a user downloads a file by using CertOC.exe
Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects execution of Chromium based browser in headless mode
Replace.exe Usage
Sigma
Detects the use of Replace.exe which can be used to replace file with another file
Detects usage of "IMEWDBLD.exe" to download arbitrary files
Detects when a user downloads a file from an IP based URL using CertOC.exe
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet
Detects Pandemic Windows Implant
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
'Finds PowerShell execution events that could involve a download'
Page 111 of 121