Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
ClickFix Payload Domain Network Traffic
Cortex XDR
Detects network connections or DNS queries to colafunfacts.net, a domain known to host malicious droppers disguised as logs and browser zip files in ClickFix campaigns.
Detects an initial payload downloader, specifically 'Browser_Updater.exe', initiating network connections to retrieve an MSI payload disguised as an 'iis.jpg' file. This rule identifies suspicious network activity based on the process name and specific network indicators (IP address or URL pattern).
cURL MSI Download and Execution
Cortex XDR
Detects the execution of cURL commands chained with msiexec to download and silently install an MSI package, a known tactic used by UNC3753 to deploy RMM tools like SuperOps.
Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.
Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Detects network connections or web proxy requests to malicious domains (such as colafunfacts.net) known to host initial droppers, decoy pages, and payload archives for the ClickFix RAT campaigns.
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
cURL Request to Raw IP for Installer
Cortex XDR
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This staging pattern is utilized by UNC3753 to deploy RMM payloads on victim machines.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Detects process creation where ConfigurationRemotingServer.exe is spawned by winget.exe or WindowsPackageManagerServer.exe. This activity indicates potential WinGet DSC (Desired State Configuration) execution or COM API abuse. Adversaries may leverage WinGet to execute malicious configurations or scripts.
Detects HTTP/DNS network traffic attempting to download the Bun runtime from the specific GitHub releases path. This behavior is exhibited by the malicious Python loader in the Hades PyPI supply chain attack to stage its execution environment.
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
Detects instances where curl.exe is used to download payloads from storage.googleapis.com, with the initiating process being a .lnk file. This behavior is characteristic of the PXDropper/10FXRAT LNK campaign.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
Detects suspicious file downloads from the internet where common DLLs (wininet.dll, urlmon.dll, msxml3.dll) are initiating the file creation of executable, DLL, PowerShell, or batch files. The rule specifically looks for scenarios where 5 or more such files are created by the same initiating process on a device, indicating potential malicious activity like ingress tool transfer.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
7-Zip Spawns Suspicious Process (LOLBin)
Cortex XDR
Detects a 7-Zip process, the CLI binaries (7z.exe/7za.exe), the GUI worker (7zG.exe), or the File Manager (7zFM.exe) spawning a command interpreter, script host, proxy-execution LOLBin, or download/staging utility as a child. This pattern indicates archive-delivered payload execution, where adversaries use encrypted or password-protected archives to evade mail and AV inspection and the payload runs when the recipient extracts it, as well as scripted CLI abuse for tool execution or exfil staging. Logic is split by parent: the CLI and worker binaries fire unqualified since they have no legitimate reason to spawn these children, while the File Manager requires a suspicious command-line marker to suppress the benign baseline of users double-clicking files inside an archive.
Detects download of malware builder or generator tools from code repositories
Page 83 of 121