Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Curl Usage on Linux
Sigma
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server
Detects the use of wget to download content to a suspicious directory
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects when a user downloads a file by using CertOC.exe
Detects usage of the "type" command to download/upload data from WebDAV server
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Detects execution of the IEExec utility to download and execute files
Download and compress a remote file and store it in a cab file on local machine.
Download or Copy file with Extrac32
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Yara rule that detects Menorah backdoor.
Replace.exe Usage
Sigma
Detects the use of Replace.exe which can be used to replace file with another file
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Page 120 of 121