Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation
PUA - Nimgrab Execution
YARA-L
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Remote File Copy
Sigma
Detects the use of tools that copy files from or to remote systems
This rule detects suspicious usage of the 'curl' command on Linux systems that indicates a file upload or data transfer to a web service. It specifically looks for the 'curl' executable being run with command-line arguments such as '--form', '--upload-file', '--data', or their variations ('--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), or the shorthand options '-F', '-T', '-d'. The rule filters out connections to localhost or 127.0.0.1 to reduce false positives from legitimate local development or testing activities.
Detect web traffic to a recently expired domain followed by an exe file creation event
Detects files with suspiciously structured names potentially related to stage 2 malware delivery, focusing on those that contain specific HTML and image file extensions. This is specifically related to known malware TTPs related to Qakbot.
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
Detects a suspicious curl process start the adds a file to a web request
The analytic detects the use of .NET classes in PowerShell to download a URL payload directly into memory, a common fileless malware staging technique. It leverages PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell commands involving `system.net.webclient`, `system.net.webrequest`, and `IO.MemoryStream`. This activity is significant as it indicates potential fileless malware execution, which is harder to detect and can bypass traditional file-based defenses. If confirmed malicious, this technique could allow attackers to execute code in memory, evade detection, and maintain persistence in the environment.
This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. It leverages Cisco Secure Firewall Threat Defense logs and focuses on the IntrusionEvent event type to detect activity that may indicate broad targeting or mass exploitation attempts. This behavior is often associated with opportunistic scanning, worm propagation, or automated exploitation of known vulnerabilities across multiple systems. If confirmed malicious, this could represent the early phase of a coordinated attack aiming to gain a foothold on several hosts or move laterally across the environment.
The analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
This detection identifies when a new Microsoft Intune device health script has been added, updated, or deleted. Intune device remediation scripts can be used by administrators for remote device management, but this functionality can also be abused for SYSTEM-level code execution and lateral movement to Intune-managed devices.
The following analytic detects the use of Certify or Certipy tools to enumerate Active Directory Certificate Services (AD CS) environments. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line arguments associated with these tools. This activity is significant because it indicates potential reconnaissance or exploitation attempts targeting AD CS, which could lead to unauthorized access or privilege escalation. If confirmed malicious, attackers could gain insights into the AD CS infrastructure, potentially compromising sensitive certificates and escalating their privileges within the network.
The following analytic detects the use of curl on Linux or MacOS systems to download a file from a remote source and pipe it directly to bash for execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant as it is commonly associated with malicious actions such as coinminers and exploitation of vulnerabilities like CVE-2021-44228 in Log4j. If confirmed malicious, this behavior could lead to unauthorized code execution, system compromise, and further exploitation within the environment.
This analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443) from Cisco Secure Firewall Threat Defense logs. Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious, this indicates potential malware delivery or other nefarious activity.
Page 115 of 121