Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
752 detections
Filters
Last updated
All Time
Detection languages
359
138
78
48
41
Contributors
208
117
105
52
51
Categories
20,407
11,798
5,867
5,145
4,864
752
Platforms
523
138
55
46
39
Products / Services
193
171
94
51
51
MITRE Techniques
493
378
310
189
156
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
3
2
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging or cleanup operations, often used to execute temporary scripts or hide traces of execution.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects the use of native Windows administration tools (vssadmin, wmic, wbadmin, and bcdedit) to inhibit system recovery. Actions include deleting volume shadow copies, deleting the backup catalog, disabling Windows automatic recovery, or tampering with boot status policies. Such activities are commonly associated with ransomware operations intended to prevent system restoration and increase the impact of data destruction.
This rule detects sequences of suspicious administrative commands often used by attackers to gain control over files or clear system artifacts. It monitors the combined use of 'takeown.exe' to change file ownership, 'icacls.exe' to modify file permissions, and 'cmd.exe' to perform mass file deletions, particularly targeting sensitive system directories like System32 or SysWOW64.
Detects unauthorized deletion, renaming, or movement of system command-line utilities (cmd.exe) located in System32 or SysWOW64, correlated with the use of standard Windows tools to delete Volume Shadow Copies. This behavior is indicative of ransomware preparation to inhibit system recovery and interfere with standard administration tasks.
Detects the unauthorized deletion of cmd.exe from System32 or SysWOW64 by a non-system process, correlated with the creation of a new service or scheduled task on the same host within 60 seconds, which is characteristic of TrymeLocker malware persistence and tampering.
Detects the specific behavior associated with the TrymeLocker malware DestroyCMD function, which involves stripping file permissions from cmd.exe using takeown and icacls, followed by the deletion or renaming of cmd.exe within the System32 or SysWOW64 directories to disable command execution.
Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.
Correlates the creation and immediate deletion of the 'trin.tar.gz' archive, which is handled by the Python temporary-directory context manager, indicating potential malicious activity associated with TeamPCP.
Detects the Pay2Key ransomware dropper's attempt to obfuscate its presence by using 'fsutil setZeroData' to wipe its own binary content followed by the deletion of associated executable and batch cleanup scripts to hinder forensic investigation.
Detects LCRYX ransomware and similar malicious activity involving the deletion of volume shadow copies, backup catalogs, and the disabling of system recovery features using standard Windows administrative utilities such as vssadmin, wbadmin, wmic, and bcdedit.
Detects the execution of PowerShell or Command Prompt initiated by Windows script interpreters (wscript.exe, cscript.exe) that contain command-line arguments indicative of malicious activity. This includes commands related to raw disk access, system recovery inhibition (e.g., shadow copy or backup catalog deletion), and boot configuration manipulation often associated with ransomware or wiper activity.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.
This rule detects the behavior of a temporary executable making a network connection and then deleting itself shortly afterwards. It specifically looks for file creation and deletion events of executables within temporary directories (e.g., \temp or \appdata\local\temp) where the context process is a command-line interpreter or another executable. The rule's logic is designed to identify specific malware structures like SessionGate, Remus, or AnimateClipper rather than generic executable names.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
Detects common anti-forensic staging patterns used by IoT botnets such as TerraBot, r00ts3c, and RondoDox. The rule identifies processes that stage payloads in the /tmp directory, set world-writable execution permissions (chmod 777), and immediately delete artifacts following execution to hinder forensic analysis.
Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1' combined with a file deletion command ('del', 'delete', 'erase'). This pattern is often used by malware, such as ransomware, to introduce a delay before self-deletion or to ensure network connectivity before performing destructive actions, followed by an attempt to remove its traces.
Detects Python deleting runtime scripts, compiled modules, screenshots, and credential archives from temporary or profile paths. This rule specifically looks for file deletion or creation events where the target file matches common Python script/module extensions (.py, .pyc, .pyd, .so) or archive/image extensions (.zip, .7z, .png, .jpg) within temporary or user profile directories, and the process responsible is identified as Python.
Page 25 of 36