Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects PowerShell utilizing the Start-BitsTransfer cmdlet to download the 'syncobs.exe' payload, a known indicator for the PHANTOMPULL loader stage in the REF6598 campaign (PHANTOMPULSE RAT).
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects cmd.exe spawning PowerShell to download a file using System.Net.WebClient to the Windows Temp directory. This pattern was observed in the DAEMON Tools supply chain attack to drop secondary payloads.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdate' that leverages PowerShell to download and execute a payload. This technique was observed in an Iranian-Nexus operation against Oman's government.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
This rule detects common PowerShell patterns used for downloading content from the internet and then executing it. It looks for a combination of download-related commands/objects (e.g., DownloadString, Invoke-WebRequest, Net.WebClient) and execution-related commands/objects (e.g., IEX, Invoke-Expression, Invoke-Command, ScriptBlock) within PowerShell command-line activity. This behavior is frequently observed in malware and adversary tradecraft for initial access, execution, and persistence.
Detects the use of bitsadmin.exe to download a file with a foreground priority. This specific command line structure is used by the CloudZ RAT as a fallback payload download mechanism when curl and PowerShell Invoke-WebRequest fail.
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
Detects process executions where the command line contains an HTTP/HTTPS URL with an explicit IPv4 address instead of a domain name. This technique is often used by malware and downloaders to fetch payloads or communicate with C2 servers while bypassing DNS.
Detects the download of the public proof-of-concept exploit script for CVE-2026-31431 (CopyFail) from the known payload domain 'copy.fail'. Attackers or testers may use utilities like curl or wget to retrieve the payload directly to a vulnerable system.
Detects the java.exe (ActiveMQ) process spawning cmd.exe to run certutil for payload delivery. This is highly indicative of CVE-2023-46604 post-exploitation activity, leading to Metasploit and LockBit ransomware deployment.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Detects the use of the curl utility to download files from bashupload.app, an anonymous file-sharing service. This behavior was observed in Tropic Trooper campaigns to stage payloads and tools during post-exploitation.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
Detects copying or writing certificate material and modifications to system keychains. Execution of `security add-trusted-cert`.
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
Detects the execution of PowerShell using the ExecutionPolicy Bypass flag combined with the Net.WebClient DownloadFile method. This pattern is frequently used by threat actors and ransomware affiliates, such as The Gentlemen RaaS, to stage payloads from internal or external servers.
Page 86 of 121