Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
Detects the deletion of immutability policies on Azure blob containers. Immutability policies protect critical data from being tampered with; their deletion is a necessary step for attackers aiming to encrypt or destroy backups and storage data prior to a ransomware event.
This rule correlates suspicious process initiation originating from common web browsers or document handlers (e.g., encoded PowerShell, obfuscated CMD) with subsequent high-impact activities such as QEMU emulator launch, local account creation, DLL side-loading, volume shadow copy deletion, or creation of ransom-related files. This detection follows a multi-stage logic to identify potentially advanced threats or ransomware precursors within a 4-hour window.
This rule detects the use of native Windows utilities to inhibit system recovery (e.g., deleting shadow copies or boot configuration changes) and to clear system event logs. These behaviors are common precursors or indicators of post-exploitation activity, such as ransomware deployment or intrusion cleanup.
Detects deletion of VSS copies used by ransomware to prevent recovery
Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.
Detects the use of built-in Windows utilities 'wbadmin.exe' and 'bcdedit.exe' with arguments that inhibit system recovery features. Specifically, it monitors for the deletion of the Windows Backup Catalog using 'wbadmin.exe' and the disabling of system recovery/boot failure handling via 'bcdedit.exe'. These actions are commonly performed by ransomware or adversaries to prevent system recovery.
Detects the use of legitimate Windows administrative tools and scripts to disable or delete system recovery features, such as Volume Shadow Copies, backup catalogs, or boot recovery options. This behavior is a common indicator of ransomware or destructive malware attempting to prevent system restoration.
Detects the use of built-in Windows utilities (vssadmin, wbadmin, bcdedit) to delete volume shadow copies, clear backup catalogs, or modify boot configuration settings to disable recovery features, which is a common precursor to ransomware encryption.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
Detects attempts to delete volume shadow copies using 'vssadmin' or 'wmic shadowcopy' commands. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially during ransomware attacks or data destruction efforts.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
Detects the deletion of volume shadow copies using standard Windows utilities like vssadmin.exe or wmic.exe, combined with concurrent file activity in multiple directories, a behavior frequently observed during the impact phase of a ransomware attack (specifically associated with the Qilin ransomware family).
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete or resize Volume Shadow Copies. This is a common technique used by ransomware to prevent system recovery and inhibit administrative rollback of file changes.
Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
Page 11 of 28