Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects child processes spawned by "MicrosoftEdgeUpdateCore.exe" when it is located in the AppData directory. This behavior is characteristic of the LeakyStealer malware executing downloaded payloads or system commands as part of its post-exploitation activities.
Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound
This rule detects HTTP requests to archive.org for image files (png, jpg, jpeg, svg, gif, tiff) that have minimal request headers, specifically lacking both 'User-Agent' and 'Referer' headers. This behavior can be indicative of automated tools or malware attempting to retrieve content while trying to evade detection or hide their origin.
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound
ET ATTACK_RESPONSE ClickFix Related Payload Inbound
ET ATTACK_RESPONSE ClickFix Webpage Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound
Cisco Stage Data
Sigma
Various protocols maybe used to put data on the device for exfil or infil
Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet
ET MALWARE Observed VBScript Payload Downloader Inbound
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
Detects the suspicious execution of `certreq.exe` with command-line arguments indicative of downloading a file. This behavior is often abused by attackers to download additional payloads or configuration files from a remote HTTP source. `Certreq.exe` is a legitimate Windows utility for certificate management but can be repurposed for malicious ingress tool transfer.
Page 98 of 121