Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.
Detects the use of the Windows Defender command-line utility, MpCmdRun.exe, to download files. This utility is typically used for managing Windows Defender, but adversaries can abuse its 'DownloadFile' function to retrieve arbitrary files from a specified URL, often for staging malicious payloads or tools.
This rule detects the execution of the `finger.exe` utility on Windows systems. `finger.exe` is an old utility used to display information about users on a specified remote computer running the finger service. Given its age and the rarity of the finger service on modern systems, any execution of this utility is considered suspicious and warrants investigation.
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
This rule detects the execution of 'nimgrab.exe', a tool associated with the Nim programming framework, which is often used for downloading files. Detection is based on the process name 'nimgrab.exe' or specific file hashes (MD5, SHA256, Imphash) associated with known nimgrab binaries. This tool can be abused by adversaries for ingress tool transfer.
Detects suspicious usage of `curl.exe` on Windows to download files into common temporary or user-controlled directories. This rule specifically looks for `curl.exe` being executed and writing its output to locations like `%appdata%`, `%public%`, `%temp%`, user desktop, or common temporary system directories, often associated with malware staging or persistence. It also identifies downloads of specific file extensions commonly used for malicious payloads.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from known file-sharing or content delivery network (CDN) websites. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects the execution of `certutil.exe` with specific command-line arguments (`urlcache` or `verifyctl`) combined with an HTTP URL, indicating an attempt to download files using this utility. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects suspicious attempts to download files from legitimate Microsoft domains (Outlook and OneNote) using command-line tools or PowerShell. Adversaries may leverage these trusted domains to host malicious files, bypassing traditional perimeter defenses and making the activity appear legitimate. The rule specifically looks for common download utilities like curl, wget, Invoke-WebRequest, and Start-BitsTransfer in conjunction with specific Microsoft attachment/sync domains.
Finds PowerShell execution events that could involve a download.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.
Detects Deno writing a file from a direct HTTP(s) call to the AppData folder or introducing its own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through Deno.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Finger.EXE Execution
YARA-L
Detects execution of the finger.exe utility. Finger.EXE or \"TCPIP Finger Command\" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of finger.exe can be considered suspicious and worth investigating.
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
Alert on downloading a known file hash from a known IP with VT Relationships.
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Alert on downloading a known file hash from a known IP with VT Relationships.
Page 114 of 121