YARA rules tagged DOWNLOAD
4 rules carry the tag “DOWNLOAD”.
- SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Detect a Download to %temp% and execution with rundll32.exe
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Detect a Download to %temp% and execution with rundll32.exe
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMetadata only
Detects a .NET Binary that downloads further payload and retrieves a special folder
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27