Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the usage of one of three Microsoft office applications (Word, Excel, PowerPoint) to download arbitrary files
Detects code execution via the Windows Update client (wuauclt)
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects usage of the "type" command to download/upload data from WebDAV server
Detects execution of the IEExec utility to download and execute files
Download and compress a remote file and store it in a cab file on local machine.
Detects suspicious ways to download files or content using PowerShell
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Download or Copy file with Extrac32
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects execution of Chromium based browser in headless mode
Replace.exe Usage
Sigma
Detects the use of Replace.exe which can be used to replace file with another file
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Page 112 of 121