Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects a network connection initiated by the certutil.exe utility. Attackers can abuse this utility to download malware or additional payloads.
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. This behavior can be indicative of an adversary attempting to transfer tools or execute scripts from internal network shares.
This rule detects outbound network connections initiated by the Windows Script Host interpreters, wscript.exe or cscript.exe, to non-local IP addresses. This behavior is often indicative of adversaries using scripts to download additional malicious payloads or establish command and control. The rule filters out connections to common private and loopback IP ranges to reduce false positives.
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from direct IP addresses. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads, bypassing traditional web proxies or security controls that might monitor domain-based traffic.
Detects the use of the built-in Windows utility `desktopimgdownldr.exe` to download remote files. This utility can be abused by adversaries as an alternative method for ingress tool transfer, similar to `certutil.exe`.
This rule detects suspicious execution of 'extrac32.exe' when it is used to download or copy files, specifically cabinet (.cab) files, with common extraction options. Extrac32.exe is a legitimate Windows utility for extracting files from cabinet archives, but it can be abused by adversaries for ingress tool transfer or to stage malicious files.
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
MsiExec Web Install
Sigma
Detects suspicious execution of msiexec.exe with web addresses as parameters, which can be indicative of an adversary attempting to download and execute malicious MSI packages or DLLs directly from a remote source. This technique is often used for defense evasion and ingress tool transfer.
Detects the usage of COM objects within PowerShell commands that can be leveraged to download files. This rule specifically looks for the `[Type]::GetTypeFromCLSID(` method combined with known Class IDs (CLSIDs) associated with objects capable of file downloads.
Detects suspicious file downloads directly from IP addresses using Wget.exe. This rule looks for executions of wget.exe where the command line contains an IP address, 'http', an output flag like '-O' or '--output-document', and a suspicious file extension. This behavior is often associated with adversaries transferring tools or malware onto a compromised system.
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Detects suspicious PowerShell commands that utilize the Net.WebClient object to download files or strings from the internet. This is a common technique used by adversaries for ingress tool transfer or to execute malicious code.
Detects the execution of common browser processes (Brave, Chrome, Edge, Opera, Vivaldi) with a command-line argument containing a URL that points to a file with a potentially interesting extension. This behavior can be abused by adversaries to download arbitrary files, potentially for further execution or to hide malicious activity by launching the browser in a minimized state.
Detects suspicious command line execution by `cmd.exe` that includes both a URL (http or https) and the `%AppData%` environment variable in its parameters. This pattern is often observed in droppers, particularly those using JavaScript or VBScript to execute PowerShell commands.
This rule detects the execution of 'curl.exe' to download files from a direct IP address, rather than a domain name. It specifically looks for command-line arguments that indicate a download operation (e.g., '-O', '--remote-name', '--output') and the presence of an IP address in the URL. The rule also filters for common executable and script file extensions, suggesting the download of malicious payloads. This activity is often associated with adversaries attempting to retrieve tools or malware onto a compromised system, bypassing typical domain-based reputation checks.
This rule detects the execution of 'diantz.exe' with command-line arguments that indicate both a remote file path (identified by '\\') and the creation of a CAB file (identified by '.cab'). This combination suggests that the 'diantz.exe' utility is being used to download a remote file and compress it into a CAB archive on the local machine. This behavior is often associated with adversaries transferring tools or data into a compromised environment.
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL
Page 119 of 121