Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
234 detections
Filters
Last updated
All Time
Detection languages
91
65
32
11
10
Contributors
44
31
29
23
20
Categories
88
86
85
64
29
Platforms
184
28
17
6
5
Products / Services
49
49
38
38
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
Identifies when an Azure Kubernetes Pod is deleted. This activity could indicate an attempt to disrupt services, evade detection, or remove evidence by an attacker. Monitoring these deletions is crucial for maintaining the integrity and availability of Kubernetes deployments.
Detects a command used by the Conti ransomware group to list volume shadow copies and redirect the output to a log file. This activity is often a precursor to deleting shadow copies to prevent system recovery.
Detects when adversaries delete important scheduled tasks related to system restore, Windows Defender, BitLocker, Windows Backup, Windows Update, Update Orchestrator, or Exploit Guard. This activity could indicate an attempt to disrupt system services or processes, potentially as a precursor to data destructive activities or to hinder defensive capabilities.
Detects the usage of utilities such as 'systemctl', 'service', and 'chkconfig' to stop or disable services on a Linux system. This activity can be indicative of an adversary attempting to impair defenses or disrupt system operations.
This rule detects when an application has been uninstalled from a Windows system. It specifically looks for MsiInstaller events with EventIDs 1034 (Windows Installer removed the product) or 11724 (Product Removal Successful). This can be an indicator of an adversary attempting to remove security software or other critical applications to hinder detection or response efforts, or simply to clean up their tracks.
This rule detects the termination of important Windows services, such as antivirus, firewall, Microsoft Defender components, BitLocker, and Encrypting File System (EFS). It specifically looks for Event ID 7023 from the 'Service Control Manager' provider, indicating a service termination with an error. The rule identifies critical services by their display names (which can be language-specific) or by their wide hex-encoded service names in the 'Binary' field of the event.
Detects the stopping of a Windows service using the built-in 'sc.exe' utility. This rule specifically looks for process creation events where 'sc.exe' is executed with the 'stop' command-line argument. While 'sc.exe' is a legitimate system tool, its use to stop services can be indicative of malicious activity, especially when combined with other suspicious behaviors, as adversaries may stop services to disrupt operations, evade defenses, or facilitate data destruction/encryption.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the usage of 'schtasks.exe' with the '/delete' flag and the '/tn *' argument, which is used to delete all scheduled tasks on a local Windows system, including those created by other users. This activity can be indicative of an adversary attempting to disrupt system operations or remove forensic evidence.
Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
An application has been removed. Check if it is critical.
Detects the stopping of a Windows service via the "net" utility.
Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
Yara rule that detects Cactus ransomware.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the Blitzkrieg ransomware by identifying specific byte patterns associated with its core functionalities: file encryption, searching for files to encrypt, and disabling services. The rule looks for distinct sequences of bytes that indicate these malicious behaviors within a Windows executable file.
This rule detects the WannaCry ransomware based on specific byte patterns found within the executable. It checks for a valid PE header and then matches a combination of byte sequences at the entry point and various other locations within the binary, indicative of WannaCry's code.
Page 11 of 12