Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
12
11
10
5
4
Contributors
10
7
7
4
3
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
27
12
9
4
1
Products / Services
12
11
11
6
5
MITRE Techniques
38
32
9
7
4
CVEs
2
2
2
IDS Classtypes
5
IDS Protocols
5
This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.
This rule detects the execution of system commands commonly used to shut down, reboot, or halt a macOS system. Adversaries may use these commands to disrupt system availability or aid in the destruction of systems.
This rule detects the execution of the 'shutdown.exe' command-line utility with parameters '/r' (reboot) or '/s' (shutdown). This activity can be indicative of an adversary attempting to impact system availability by shutting down or rebooting a Windows system.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Page 3 of 3