Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
Detects the use of the BITSAdmin utility to transfer files or set notification command lines. BITSAdmin is a legitimate Windows utility often abused by adversaries to download malicious files or achieve persistence/execution via BITS jobs.
Detects a batch or PowerShell loader reading 'msedge.txt' from a writable path (Temp, AppData, Downloads, ProgramData) and treating its content as encoded executable data. This behavior is indicative of the Banana RAT malware.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
Detects the use of PowerShell commands that leverage 'Invoke-Expression' (IEX) in conjunction with 'Net.WebClient' or 'DownloadString' methods to download and execute code directly from the internet into memory.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfers, specifically targeting non-Microsoft signed processes. Adversaries often abuse the Background Intelligent Transfer Service (BITS) to download malicious payloads or exfiltrate data, as it is a legitimate Windows service that operates in the background.
Tracks network communication matching specific ClickOnce deployment URLs traversing over unencrypted HTTP. This rule identifies attempts to download or access ClickOnce application deployment files (.application) over unencrypted HTTP, which could indicate a potential supply chain attack or malware delivery mechanism.
This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects PowerShell execution involving Node.js related artifacts such as downloads from nodejs.org, extraction of specific Node.js archive versions, or interaction with Node.js installation directories. This activity is indicative of potential unauthorized software installation or preparation for execution of Node.js-based applications or tools on a Windows system.
Detects indicators of the DragonReturn malware campaign, specifically the download and deployment of malicious payloads hidden within image files. The rule monitors for network connections to known malicious infrastructure, the creation of specific steganographic staging files in sensitive directories, and the use of the URLDownloadToFile API to retrieve these payloads.
Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.
Detects the use of certutil.exe to download files from remote URLs using the -urlcache flag or decode files using the -decode flag. This behavior is indicative of a living-off-the-land technique used by adversaries to fetch or prepare malicious payloads.
Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.
Page 71 of 121