Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
1
1
1
Platforms
3
Products / Services
1
1
MITRE Techniques
1
1
1
IDS Classtypes
1,937
503
461
381
236
3
Delete Windows shadow copies before it begins encrypting the data on the victim host. This tactic is typically carried out with powershell, vssadmin or wmic.
This use case detects when shares are mapped via "net.exe" within command line. More specifically, hidden administrative shares that can be mapped and used to remote file copy malicious files and/or executables.
This use case is meant to identify Run registry key modifications which point to a file located within the "C:\Users\Public" folder.