Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the execution of 'IEExec.exe' with command-line arguments containing 'http://' or 'https://', indicating an attempt to download and execute files from a remote web server. This utility is part of the .NET Framework and can be abused by adversaries for ingress tool transfer.
Detects the execution of "Ldifde.exe" with the import flag "-i" and a file specified by "-f". This can be abused to import data, potentially from remote HTTP sources, leading to arbitrary file downloads or data injection.
Detects the use of 'curl.exe' to download files by looking for specific command-line arguments such as '-O', '--remote-name', or '--output'. This activity can indicate an adversary transferring tools or other files into a compromised environment.
Detects the use of the 'wget' utility to download and create files within common temporary directories like '/tmp' or '/var/tmp' on Linux systems. This activity can be indicative of an adversary performing ingress tool transfer or staging malicious files.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
Detects the creation of a suspicious file by 'svchost.exe' in the 'Personalization\LockScreenImage' directory, specifically looking for files that are not in the 'C:\Windows\' directory and do not have common image extensions like '.jpg', '.jpeg', or '.png'. This behavior can indicate an adversary attempting to download or stage malicious files using the 'desktopimgdownldr' functionality, which is often associated with T1105 (Ingress Tool Transfer).
Detects usage of the "type" command to download/upload data from WebDAV server. This technique can be used by adversaries to transfer files into or out of a compromised environment.
Detects suspicious execution of the Microsoft desktopimgdownldr utility. This utility is being used with parameters to download files from the Internet, specifically when the '/lockscreenurl:' argument is present and the downloaded file is not a common image format (like .jpg, .jpeg, or .png), or when it's used in conjunction with 'reg delete' and '\PersonalizationCSP' to potentially manipulate system settings related to personalization. This behavior can indicate an adversary attempting to download malicious payloads or modify system configurations.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
Detects when the CertOC.exe utility is used to download a file from a remote HTTP source. This behavior is indicative of an adversary using a living-off-the-land binary (LOLBIN) for ingress tool transfer.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') in conjunction with an 'http' string in the command line, indicating an attempt to download files from a remote HTTP source. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects the usage of winget to add new additional download sources. Adversaries may abuse this functionality to introduce malicious package repositories, potentially leading to the download and execution of unauthorized software or tools.
Detects attempts to add an insecure (HTTP) download source to Winget. While Winget is designed to prevent the addition of insecure sources, this activity could indicate an attempt to bypass security controls or a user error. This rule specifically looks for the execution of 'winget.exe' with 'source add' and 'http://' in the command line.
This rule detects the usage of the Windows Package Manager (winget.exe) to install applications via a local manifest file. Adversaries can abuse winget to download and execute various types of payloads (e.g., .exe, .msi, .msix) from remote sources by providing a YAML manifest file directly to the client. This technique can be used for execution and defense evasion.
This rule detects when the `IMEWDBLD.exe` process initiates a network connection. This behavior is suspicious because `IMEWDBLD.exe` is a legitimate Microsoft Windows component (Input Method Editor Word Dictionary Builder) that is not typically expected to make outbound network connections. Adversaries may abuse this utility as a Living Off The Land Binary (LOLBIN) to download additional payloads or exfiltrate data, leveraging its trusted status to evade detection. The detection focuses on the initiation of any network connection by this specific executable.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
Detects the execution of 'GfxDownloadWrapper.exe' with a URL as a command-line argument, indicating an attempt to download a file. This utility is part of Intel Graphics Command Center and can be abused for ingress tool transfer.
This rule detects suspicious PowerShell command-line patterns indicative of downloading and executing remote content. Specifically, it looks for the use of `IEX (New-Object Net.WebClient).DownloadString` or `(New-Object System.Net.WebClient).DownloadFile` which are commonly abused by malicious scripts, stagers, and downloaders to fetch and run payloads from the internet.
This rule detects when the 'EnableLocalManifestFiles' setting for AppInstaller (winget) is activated in the Windows Registry. Enabling this setting allows users to install new packages using custom manifests, which could be abused by adversaries to install malicious software or achieve persistence.
Page 118 of 121