Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
72
26
24
17
12
Contributors
62
35
12
11
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
93
62
25
21
12
Products / Services
36
31
23
15
12
MITRE Techniques
73
52
42
30
26
CVEs
3
2
IDS Classtypes
2
1
IDS Protocols
2
Detects a suspicious sequence of activities in GCP Compute Engine where a principal creates a new VM instance, attaches a disk, and creates a disk snapshot or new disk within a short window, potentially indicating data staging or exfiltration preparation.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects the execution of processes associated with virtualization platforms, hypervisors, virtual machine management utilities, and containerization technologies on Windows endpoints.
The detection identifies executable names related to Microsoft Hyper-V, VMware, Oracle VirtualBox, QEMU, Xen, Parallels, WSL, and container runtimes such as Docker and containerd.
The detection identifies executable names related to Microsoft Hyper-V, VMware, Oracle VirtualBox, QEMU, Xen, Parallels, WSL, and container runtimes such as Docker and containerd.
Detects the modification or setting of the execInstalledOnly parameter to false, 0, or disabled on VMware ESXi or Linux hosts via process execution command lines or syslog messages, often associated with running uninstalled or arbitrary scripts/binaries in virtualized environments.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
Detects when a large number of virtual machines are powered off by a single user or initiator within a short timeframe, which can be an indicator of malicious availability interruption or virtualization disruption (such as ransomware preparation).
Detects VMware ESXi shell activity associated with the ShinySp1d3r encryptor. This includes the termination of VM processes via esxcli or vim-cmd, the deletion of VM snapshots, and suspicious file renaming or encryption activity on datastores consistent with ransomware behaviors.
Detects the installation of the Windows Subsystem for Linux (WSL) feature via dism.exe or wsl.exe, or the execution of wsl.exe for non-standard administrative tasks. This activity is often a precursor to running Linux-based tools or malware on a Windows host.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
Detects the use of 'vim-cmd' or 'esxcli' to power off or terminate virtual machine processes on an ESXi host, which may indicate malicious activity such as ransom-related VM shutdown or service disruption.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
Detects instances where a successful login occurs on an ESXi/vCenter hypervisor, followed by the creation or power-on of a virtual machine on that same host within a two-hour window. This behavior is indicative of an attacker establishing access to a hypervisor environment to spin up rogue, unmonitored virtual machines to evade detection tools and facilitate further malicious activity.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Page 1 of 9