Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
12
11
10
5
4
Contributors
10
7
7
4
3
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
27
12
9
4
1
Products / Services
12
11
11
6
5
MITRE Techniques
38
32
9
7
4
CVEs
2
2
2
IDS Classtypes
5
IDS Protocols
5
Detects when a large number of virtual machines are powered off by a single user or initiator within a short timeframe, which can be an indicator of malicious availability interruption or virtualization disruption (such as ransomware preparation).
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
The following analytic detects the execution of the SysReq hack to reboot a Linux system host. It leverages Endpoint Detection and Response (EDR) data to identify processes executing the command to pipe 'b' to /proc/sysrq-trigger. This activity is significant as it is an uncommon method to reboot a system and was observed in the Awfulshred malware wiper. If confirmed malicious, this technique could indicate the presence of suspicious processes and potential system compromise, leading to unauthorized reboots and disruption of services.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects the use of the bcdedit.exe utility to configure the Windows boot configuration to enter Safe Mode (minimal or with networking), immediately followed by the execution of a shutdown command with the reboot flag. This sequence is a known technique utilized by Akira ransomware affiliates to force a system reboot into a restricted environment where security agents and endpoint detection and response (EDR) tools may fail to load, allowing for undetected encryption.
Detects host-control and management tasks (e.g., shutdown, logoff, scheduled task modification) executed as child processes of the msedge_proxy.exe process. This behavior is indicative of the BotHelper malware implant managing infected endpoints.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to force an immediate reboot (/r /t 0 /f). This behavior is often associated with disruptive activities or attempts to clear system state by unauthorized actors.
Detects the modification of a Windows Registry Run key using reg.exe to schedule a forced system shutdown. This pattern is often associated with wipers or disruptive malware attempting to ensure system unavailability upon reboot or login.
Detects a multi-stage exploitation chain for CVE-2026-15410 targeting SonicWall SMA 1000 appliances. It correlates web request logs containing path traversal sequences in a hotfix parameter, associated application log entries indicating removal of a hotfix referencing a temporary file, and subsequent system shutdown commands executed with root privileges, indicating successful privilege escalation and system compromise.
Detects the creation of a new Windows service where the service binPath points to 'anydesk.exe', optionally accompanied by a system reboot command within one hour of the service creation. This behavior is often associated with the installation or persistent configuration of remote access software.
Detects the execution of the Windows shutdown utility with arguments to force an immediate system reboot. This behavior is commonly observed during the final stages of ransomware attacks, such as NoEscape, to force the system into a state where encrypted files are finalized or to disrupt user access.
Detects a specific sequence of commands involving the termination of the AnyDesk process using taskkill, a short delay via the timeout command, and an immediate system reboot. This sequence is often associated with persistence setup or system preparation by threat actors.
Detects a Windows system BugCheck (Blue Screen of Death) event that occurs within two minutes of a process termination event. This behavior can be indicative of a process intentionally causing a system crash, often utilized by malware that abuses critical-process protection or attempts to evade analysis by forcing a system halt.
Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Detects the execution of forced system shutdown commands (shutdown -s -t 0) initiated via cmd.exe or PowerShell. This behavior is often observed in post-compromise scenarios, including the TonRAT campaign, to disrupt system availability.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to initiate an immediate system shutdown (timer set to 0 seconds). The rule monitors for this command being invoked by common execution engines such as cmd.exe or node.exe, which is often associated with disruptive activity or ransomware attempts.
Page 1 of 3