Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
20
14
3
1
Contributors
26
5
2
2
1
Categories
24
10
6
6
5
Platforms
38
9
5
5
3
Products / Services
13
9
6
5
4
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects the use of PowerShell to modify Windows Defender settings (e.g., disabling real-time monitoring, adding exclusions, or stopping services) using the Set-MpPreference cmdlet or service control commands. This technique is frequently utilized by ransomware actors, such as the ALPHV/BlackCat group, to neutralize security protections prior to executing malicious payloads.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects suspicious post-compromise activity associated with ALPHV/BlackCat affiliates. This rule monitors for anomalous Kerberos ticket requests (e.g., weak encryption types or TGS requests) closely followed by access to sensitive credential stores or tools on the same host, which is indicative of credential harvesting after a session hijacking or initial access event.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Page 1 of 2