Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
261 detections
Filters
Last updated
All Time
Detection languages
111
37
37
21
15
Contributors
72
35
28
28
14
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
224
37
4
2
1
Products / Services
84
73
68
49
34
MITRE Techniques
117
99
85
85
77
CVEs
4
2
1
1
1
IDS Classtypes
6
1
IDS Protocols
7
Detects the stopping of a Windows service using the built-in 'sc.exe' utility. This rule specifically looks for process creation events where 'sc.exe' is executed with the 'stop' command-line argument. While 'sc.exe' is a legitimate system tool, its use to stop services can be indicative of malicious activity, especially when combined with other suspicious behaviors, as adversaries may stop services to disrupt operations, evade defenses, or facilitate data destruction/encryption.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
Yara rule that detects Cactus ransomware.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the Blitzkrieg ransomware by identifying specific byte patterns associated with its core functionalities: file encryption, searching for files to encrypt, and disabling services. The rule looks for distinct sequences of bytes that indicate these malicious behaviors within a Windows executable file.
Yara rule that detects Blitzkrieg ransomware.
Yara rule that detects GlobeImposter ransomware.
Yara rule that detects Zeppelin ransomware.
Page 13 of 13