Ingress Tool Transfer detection rulesT1105

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

windows · process_creation

Detects Pandemic Windows Implant

windows · registry_event

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

linux · file_event

Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

macos · file_event

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

linux · process_creation

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

macos · process_creation

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows · process_creation

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

windows · process_creation

Detects execution of the IEExec utility to download and execute files

windows · process_creation

Detects when a user downloads a file from an IP based URL using CertOC.exe

windows · process_creation

Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

windows · process_creation

Detects usage of bitsadmin downloading a file to a suspicious target folder

windows · process_creation

Detects the use of Windows Defender MpCmdRun.EXE to download files

windows · process_creation

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

windows · process_creation

Detects usage of bitsadmin downloading a file with a suspicious extension

windows · process_creation

Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.

windows · process_creation

Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.

windows · file_event

Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json

windows · registry_set

Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

windows · network_connection

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

windows · network_connection

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.

windows · network_connection

Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.

windows · network_connection

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

windows

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

windows · process_creation

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

windows · image_load

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

windows · process_access

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

windows · process_creation

Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

windows · process_creation

Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.

windows · process_creation

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

windows · process_creation

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

windows · process_creation

Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

windows · file_event

Detects usage of bitsadmin downloading a file from a suspicious domain

windows · process_creation

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

windows · process_creation

Detects an executable that isn't dropbox but communicates with the Dropbox API

windows · network_connection

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual.

windows · file_event

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

windows · process_creation

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

windows · process_creation

Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

windows · process_creation

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

windows · network_connection

Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL

windows · dns_query

Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

windows · process_creation

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

windows · process_creation

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

windows · file_event

Detects the use of wget to download content to a suspicious directory

linux · process_creation

Detects download of certain file types from hosts with dynamic DNS names (selected list)

proxy

Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

zeek

Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

windows · process_creation

Detects usage of bitsadmin downloading a file

windows · process_creation

Detects when a user downloads a file by using CertOC.exe

windows · process_creation

Detects file download using curl.exe

windows · process_creation

Detects the execution of the nscurl utility in order to download files.

macos · process_creation

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

macos · process_creation

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

windows · process_creation

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

windows · network_connection

Detects suspicious msiexec process starts with web addresses as parameter

windows · process_creation

Detects a network connection initiated from a process located in the "C:\Users\Public" folder. Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone. Use this rule to hunt for potential suspicious or uncommon activity in your environement.

windows · network_connection

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

windows · process_creation

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

windows · ps_script

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

windows · process_creation

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

windows · process_creation

Detects usage of the "type" command to download/upload data from WebDAV server

windows · process_creation

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

macos · process_creation

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

windows · process_creation

Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.

windows · file_event

Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.

windows · process_creation

Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line. These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID. This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.

windows · process_creation

Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

windows · process_creation

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

windows · process_creation

Detects the use of Replace.exe which can be used to replace file with another file

windows · process_creation

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

windows · process_creation

Detects a suspicious curl process start the adds a file to a web request

linux · process_creation

Download and compress a remote file and store it in a cab file on local machine.

windows · process_creation

Detects the execution of certutil with certain flags that allow the utility to download files.

windows · process_creation

Download or Copy file with Extrac32

windows · process_creation

Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

windows · process_creation

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

windows · network_connection

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

linux · file_event

Detects execution of Chromium based browser in headless mode

windows · process_creation

Various protocols maybe used to put data on the device for exfil or infil

cisco

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

linux · process_creation

Detects a curl process start on Windows, which could indicates a file download from a remote location or a simple web request to a remote server

windows · process_creation

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

windows · process_creation

Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.

windows · ps_classic_start

Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares. Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application. Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.

windows · process_creation

Detects the use of tools that copy files from or to remote systems

linux

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

windows · file_event