Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
90
65
32
11
10
Contributors
44
31
29
23
20
Categories
87
85
84
64
29
Platforms
183
28
17
6
5
Products / Services
48
48
38
38
19
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
Detects service-control activity stopping security, backup, database, or virtualisation services to unlock files and reduce resistance.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
Detects modification of scripts in extension folders.
Detects the creation and subsequent deletion or modification of 'wipefile.tmp' or similarly named temporary wipe artifacts, which are used by the Gentlemen ransomware during its cleanup phase. This rule specifically looks for file events (creation, deletion, modification) related to this filename.
Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.
Identifies the ransomware executing taskkill or native APIs to force-quit database and backup processes (SQL, Exchange) to free file locks. This rule specifically looks for 'taskkill.exe' being executed multiple times (more than 3 within a minute) with command-line arguments targeting common database or backup-related process names like 'sql', 'exchange', 'veeam', 'backup', or 'oracle'.
Identifies the ransomware executing taskkill or net stop to forcefully terminate SQL, Exchange, and backup services, freeing file locks for successful encryption.
Affair-Build Script Restarting VDS
Cortex XDR
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` that includes the command-line arguments related to an 'affair-build.bat' script or directly stopping/starting the Virtual Disk Service (VDS) using `net` or `sc` commands. It aims to identify cleanup or persistence script sequences that manipulate the VDS.
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
This rule detects when a single computer executes 5 or more process termination commands (taskkill or Stop-Process) within a one-hour window. This behavior can be indicative of an adversary attempting to disrupt system operations or evade defenses by stopping security tools or critical services.
This rule detects when a single computer executes 5 or more process termination commands (taskkill or Stop-Process) within a one-hour window. This behavior can be indicative of an adversary attempting to disrupt system operations or evade defenses by stopping security tools or critical services.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Remote Service Stop via SMB
Suricata
This rule detects attempts to remotely stop a service via SMB (Server Message Block) by looking for the 'svcctl' and 'StopService' strings in TCP traffic on port 445. This activity is often associated with trojan activity or other malicious impact operations.
Detects instances where the 'killall' command is used to forcefully terminate Google Chrome processes. This activity can be indicative of malware attempting to disrupt browser activity, potentially to prevent detection, interfere with user sessions, or facilitate other malicious actions. Specifically, this behavior has been associated with the FlutterShell backdoor.
Detects potentially malicious SMB activity associated with GhostLock-style
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
This rule detects potential log tampering activities on Linux systems followed by service manipulation within a 20-minute window on the same host.
This rule detects when critical services, including security agents, backup solutions, and remote management tools, are stopped on a host. Adversaries often stop these services to evade detection, disable security controls, or inhibit system recovery during attacks like ransomware.
Page 5 of 12