Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
NSIS InetLoad downloader user agent
Cortex XDR
This rule detects the distinctive 'NSIS_InetLoad Mozilla' user-agent string, which is commonly used by staged downloaders. It specifically targets network events where the process image name ends with '.exe' and either the event subtype or the remote IP contains the 'NSIS_InetLoad Mozilla' string. The rule aims to identify the initial stages of malware delivery and execution, providing causality fields for investigation.
Detects vLLM spawning download utilities like curl or wget to pull secondary payloads post-exploitation, potentially indicating a compromise related to CVE-2026-22778.
Detects AutoGen Studio spawning network download utilities to fetch secondary payloads. This rule specifically looks for processes initiated by 'autogenstudio' that then execute common download tools like curl, wget, or bitsadmin.
This rule detects suspicious command-line execution originating from common web browsers. It identifies instances where a browser process launches a command-line interpreter (cmd, powershell, or wscript) and immediately invokes known download or utility commands (curl, iwr, bitsadmin, certutil), which is a common pattern for file-less or stage-two payload delivery from malicious websites.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
Identifies characteristics of compiled Go binaries (e.g., executing from temp with specific build path signatures in memory) taking malicious actions. This rule specifically looks for process execution of an executable, combined with network connections on port 445 (SMB), and the creation or modification of files ending with '.gentlemen'.
Correlates the downloading of the secondary Mach-O backdoor (.mainhelper) into the user's home directory as a hidden file.
Detects PHP or web server processes launching tools commonly used to download or upload files. This activity can indicate a web shell or other compromise where an attacker is attempting to transfer files to or from the compromised server. Investigate the transferred destination, remote endpoint, and whether the activity occurred during an approved deployment.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Detects the creation of specific suspicious files (result.dll, KKN, ND8) in the C:\ProgramData directory, immediately followed by a network connection to known malicious IP addresses. This pattern is indicative of malware dropping and subsequent command and control communication.
Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, which is indicative of NarwhalRAT staging activity.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects certutil.exe being used to download an MSI file. This activity is often associated with adversaries using living-off-the-land binaries (LOLBINs) to download malicious payloads.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects the use of curl with specific command-line flags (-kfsSL) commonly used by Amos Stealer to silently download its initial payload, bypassing TLS warnings and hiding output. This behavior is indicative of an adversary attempting to transfer tools or malware onto a system without user interaction or visible output.
Detects non-Discord processes downloading from Discord CDN attachment endpoints (cdn.discordapp.com/attachments or media.discordapp.net). This activity is often associated with malware families like Lumma and AsyncRAT using Discord CDN to host and deliver stage-2 payloads.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
Page 78 of 121