Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
311 detections
Filters
Last updated
All Time
Detection languages
184
28
21
21
21
Contributors
88
85
46
21
17
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
259
40
20
6
3
Products / Services
113
76
51
37
35
MITRE Techniques
122
89
87
64
63
CVEs
6
5
3
1
1
Detects aggressive process and service termination using taskkill.exe and sc.exe, a technique characteristic of FunkLocker ransomware.
Detects a high volume of process and service terminations using 'taskkill.exe' and 'sc.exe' within a short time frame. This behavior is characteristic of ransomware like FunkLocker, which aggressively disables applications and services to prepare for encryption.
Detects attempts to suspend or terminate Endpoint Detection and Response (EDR) agent processes by targeting their Process IDs (PIDs). The rule identifies suspicious command-line arguments and tools (e.g., procdump, WerFault) used to interact with processes, specifically looking for these actions against a predefined list of common EDR agent executable names. It correlates process creation events with process ID resolution to identify the targeted EDR agent.
Yara rule that detects Warlock ransomware.
Detects the execution of "taskkill.exe" with the /f (force) flag, which is used to forcefully terminate processes. This activity can be leveraged by attackers for data destruction or data encryption for impact, particularly against services like Exchange and SQL Server. The rule includes filters to reduce false positives from common installer behaviors.
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. Run query
This query checks for attempts to stop at least 10 separate processes using the net stop command. Run query
The analytic detects the use of `wmic.exe` with the `delete` command to remove an executable path. This activity often indicates an adversary attempting to disable security tools or other critical processes, facilitating further compromise and persistence within the environment, potentially for malicious activities like cryptocurrency mining.
This analytic detects the termination of specific processes, namely "PServiceControl.exe" and "PService_PPD.exe", which are known targets of the Industroyer2 malware. The detection relies on Sysmon EventCode 5, indicating a process termination event. This activity is highly indicative of an attack on critical infrastructure, particularly energy facility networks, as these processes are related to industrial control systems. Such an attack could lead to severe disruption of essential services and operational control. Immediate investigation is crucial to determine the cause and mitigate potential threats.
The following analytic identifies excessive usage of `taskkill.exe`, a command-line utility used to terminate processes. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on instances where `taskkill.exe` is executed ten or more times within a one-minute span. This behavior is significant as adversaries often use `taskkill.exe` to disable security tools or other critical processes to evade detection. If confirmed malicious, this activity could allow attackers to bypass security defenses, maintain persistence, and further compromise the system.
The following analytic identifies the execution of the 'pkill' command, which is used to terminate processes on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because threat actors often use 'pkill' to disable security defenses or terminate critical processes, facilitating further malicious actions. If confirmed malicious, this behavior could lead to the disruption of security applications, enabling attackers to evade detection and potentially corrupt or destroy files on the targeted system.
The following analytic identifies the use of taskkill.exe to forcibly terminate processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific taskkill parameters. This activity is significant because it can indicate attempts to disable security tools or disrupt legitimate applications, a common tactic in malware operations. If confirmed malicious, this behavior could allow attackers to evade detection, disrupt system stability, and potentially gain further control over the compromised system.
Detects the execution of command-line utilities such as 'kill', 'pkill', 'killall', or 'xkill' to terminate or send signals to running processes on a Linux system. This activity can be indicative of an adversary attempting to disrupt services, evade defenses, or clean up their tracks.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects ShadowCryptor ransomware.
This YARA rule detects the GlobeImposter ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and process termination functions. The rule looks for combinations of these patterns within executable files to increase detection accuracy.
Page 15 of 15