Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects the creation of executable or script files by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a drive-by download, a malicious attachment being saved, or other forms of initial access where an attacker leverages a user's interaction with these applications to drop malicious payloads.
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet. This behavior can be indicative of malicious activity, as 'Cursor.exe' is not typically associated with network communication or file downloads.
Detects Visual Studio Code or similar IDE processes launching command-line interpreters (e.g., cmd, powershell, node, python) with suspicious command-line arguments indicative of file downloads, script execution, or network reconnaissance. This rule is designed to identify potential malicious extensions or compromised development environments.
Detects the execution of the Go compiler (go.exe) using command-line arguments that reference specific third-party GitHub repositories. This behavior is indicative of potential supply chain compromise, where an attacker might attempt to build or install malicious modules disguised as legitimate dependencies, or the use of automated tools that may be part of an adversary's development workflow.
This rule detects command line execution containing keywords associated with offensive security tools (e.g., 'metasploit', 'exploit', 'shellcode', 'payload') in conjunction with external resource indicators such as HTTP/HTTPS or FTP URLs, suggesting the download and potential execution of malicious payloads.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, a technique commonly used for retrieving multi-stage scripts. This behavior was observed in a campaign where curl fetched secondary batch payloads from GitHub repositories into the temp directory.
Detects command-line execution containing keywords associated with Guloader (e.g., 'guloader', 'gupl') or generic download indicators (e.g., 'download' combined with protocol identifiers like 'http', 'https', 'ftp'). This typically indicates the malicious downloading of payloads by the Guloader malware family.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
Detects instances of PowerShell being launched directly by explorer.exe. This activity is a known indicator of 'ClickFix' or similar social engineering campaigns, where users are instructed by a deceptive website or lure to copy and paste malicious PowerShell commands into the Windows Run dialog or the File Explorer address bar to execute code.
Detects a logon task or Run value that starts PowerShell with a network retrieval expression rather than a local administrative script. This rule specifically looks for modifications to registry run keys that include PowerShell or pwsh commands attempting to download content using methods like Invoke-WebRequest, DownloadString, DownloadFile, Net.WebClient, or curl.
Identifies instances where a user account established an interactive logon session from a known RedVDS IP address and subsequently executed PowerShell commands containing download patterns (Net.WebClient or DownloadString), indicative of secondary payload retrieval.
Detects the secondary PowerShell stage explicitly downloading and writing the client32.exe NetSupport Manager RAT binary to disk. This rule identifies instances where a file named 'client32.exe' is created on a device, and the process responsible for this file creation is PowerShell.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects the use of PowerShell to invoke or interact with 'cloudflared', a tool used to create secure tunnels to Cloudflare. This behavior is often associated with the deployment of malicious infrastructure or remote access tunnels for command and control purposes.
Detects compressed or packed executable payloads used to evade detection
Detects PowerShell IEX download cradle used for fileless execution
Detects the creation of files with names containing 'winPatch' and extensions of '.zip' or '.vbs' in Windows TEMP directories, originating from PowerShell or WScript processes. This behavior is indicative of potential ingress tool transfer or staging of malicious scripts.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Page 72 of 121