Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
This rule detects the use of 'curl.exe' to download files from an IP address directly specified in the command line. It specifically looks for curl.exe execution, a command line containing an IP address pattern, the 'http' protocol, and common download flags such as '-O', '--remote-name', or '--output'. This activity is often associated with adversaries transferring tools or malware onto a compromised system.
Detects a network connection initiated by programs or processes running from suspicious or uncommon file system locations. This often indicates malware execution or persistence from areas not typically used by legitimate applications for network communication.
Detects when a user downloads a file from an IP based URL using CertOC.exe
Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attackers are known to drop their malicious payloads and malware in this directory as it's writable by everyone. This rule helps hunt for potential suspicious or uncommon activity in the environment.
Detects the execution of the 'curl' command on Linux systems. This typically indicates an attempt to download files from a remote location or make web requests to external servers. This activity can be associated with adversaries transferring tools or communicating with command and control infrastructure.
This rule detects when the Notepad++ updater utility (GUP.exe) is executed by a process other than Notepad++ itself, specifically when command-line arguments indicate a file download operation (containing '-unzipTo' and 'http'). This behavior can be indicative of an adversary abusing a legitimate application's updater for ingress tool transfer or other malicious file downloads, bypassing typical security controls that might monitor direct download utilities.
Detects attempts to download executable files via WebDAV. This activity has been observed in campaigns attributed to APT29, where adversaries leverage WebDAV to transfer malicious tools into a compromised environment.
This rule detects the execution of 'osacompile' and 'curl' in the same command line. This combination is indicative of in-memory downloading and compiling of applets, a technique observed in the XCSSET malware. 'curl' is used to download content, and 'osacompile' is used to compile AppleScript or JavaScript for Automation (JXA) scripts, which can then be executed.
This rule detects specific file paths, command-line arguments, and PowerShell commands associated with the Greenbug espionage group's May 2020 campaign, as reported by Symantec. It looks for suspicious executables in ProgramData directories, the use of 'revshell.exe' and 'ncat.exe' (especially with '-e cmd.exe'), and various PowerShell command patterns indicative of malicious activity, including base64 encoded strings.
Finger.EXE Execution
Sigma
Detects the execution of the "finger.exe" utility, which is an old Windows utility used to display information about users on a remote computer running the finger service. Due to its age and the rarity of the finger service being active, any execution of this utility is considered suspicious and warrants investigation.
This rule detects the use of the `wget` command-line utility to download files into potentially suspicious directories, specifically `/tmp/`. Adversaries often use `wget` for ingress tool transfer, downloading malicious payloads or additional tools to a compromised system. The rule looks for `wget` execution combined with the `-O` or `--output-document` flags, which specify an output file, and the presence of `/tmp/` in the command line, indicating a download to a common temporary directory often abused by attackers.
This rule detects various keywords associated with data transfer and staging activities on Cisco devices. These activities could indicate an adversary attempting to move data onto the device for further exfiltration or to move data off the device. The keywords include common protocols and commands like 'tftp', 'rcp', 'puts', 'copy', 'configure replace', and 'archive tar', which are often used for file transfers and configuration management on network devices.
Detects the download of executable, script, archive, and document file types from hosts associated with dynamic DNS services. These services are often abused by adversaries for command and control or for hosting malicious content due to their ability to frequently change IP addresses, making them harder to track and block.
Detects the creation of an Alternate Data Stream (ADS) named ':Zone.Identifier' within the WinGet temporary directory, specifically when the ZoneId is '3' (Internet) and the source URL contains suspicious IP address patterns (e.g., '://1', '://2', etc.). This indicates a file downloaded from the internet via WinGet that might originate from an untrusted or suspicious source, potentially used for defense evasion or persistence.
Detects the execution of the Windows LOLBIN (Living Off The Land Binary) PrintBrm.exe when it is used to create or extract ZIP files. This activity is generally not expected on a normal workstation and can indicate malicious use for data staging or exfiltration.
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
Detects the execution of 'curl.exe' on Windows systems. This activity can indicate an attempt to download files from a remote location, make web requests to external servers, or potentially be used for command and control communication. Adversaries often use tools like curl for ingress tool transfer or to retrieve additional malicious payloads.
Detects when a password-protected ZIP archive is opened on a Windows system, specifically looking for archives with suspicious filenames commonly used in phishing or social engineering attacks (e.g., 'invoice', 'order', 'payment'). This rule leverages Windows Security Event ID 5379, which indicates a sensitive privilege use, and filters for events related to the Microsoft_Windows_Shell_ZipFolder:filename provider, combined with a list of suspicious keywords in the TargetName field.
Detects DNS queries made by "AppInstaller.EXE" when attempting to load or install an AppX package from a referenced URL. This activity is indicative of the AppInstaller being used, which is the default handler for the "ms-appinstaller" URI scheme. This can be abused by adversaries for ingress tool transfer.
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
Page 117 of 121