Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects potential malicious and unauthorized usage of 'bcdedit.exe' by monitoring process creation events. Specifically, it looks for 'bcdedit.exe' being executed with command-line arguments related to deleting boot entries or values, importing boot data, or enabling safe boot with network capabilities. Such commands can be indicative of ransomware attempting to tamper with the Master Boot Record (MBR) or other boot configurations to prevent system startup or establish persistence, or other forms of bootkit activity.
Detects command line activity that attempts to clear or disable Event Tracing for Windows (ETW) trace logs. This behavior is indicative of logging evasion, where an attacker tries to remove or prevent the collection of forensic evidence.
Detects usage of PowerShell cmdlets to disable or remove Event Tracing for Windows (ETW) trace sessions. This activity can be an attempt by an adversary to impair defenses by blocking or removing indicators that would normally be collected by security monitoring tools.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
This rule detects suspicious invocations of the `fsutil.exe` utility, specifically when it's used to delete the USN journal, create a USN journal with a small size, or set zero data to a file. These actions are often associated with ransomware or other malicious activity aimed at defense evasion and data destruction, as seen in campaigns like NotPetya and Lockbit.
Detects attempts to unload the Sysmon filter driver using 'fltmc.exe'. This activity is often indicative of an adversary trying to impair defenses and remove forensic evidence by disabling Sysmon's monitoring capabilities.
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Page 10 of 10