Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
This rule detects the use of standard Windows administrative utilities (vssadmin, wmic, bcdedit) to delete volume shadow copies or modify boot configuration settings to disable recovery features. This behavior is a common indicator of ransomware or destructive malware activity attempting to prevent system restoration after data encryption or destruction.
This rule detects potential ransomware activity by monitoring for the deliberate inhibition of Windows system recovery features (via vssadmin, wmic, or bcdedit) and the subsequent staging of archived data in public user directories.
Detects the execution of native Windows utilities (vssadmin, wbadmin, bcdedit, diskshadow) configured to delete volume shadow copies, remove backup catalogs, or disable automatic recovery features. This activity is a common indicator of ransomware preparation to prevent data recovery.
Detects a burst of commands consistent with Akira ransomware's recovery inhibition phase, where multiple system recovery features are disabled or deleted (e.g., Volume Shadow Copies, Windows Backup Catalog, Boot Recovery) within a 5-minute window on the same endpoint.
This rule detects the execution of 'REAGENTC.EXE' with the '/disable' argument and 'WBADMIN.EXE' with 'delete catalog -quiet' within a 10-minute window on the same device. This combination of commands is indicative of an adversary attempting to inhibit system recovery by disabling Windows Recovery Environment and deleting the Windows Backup Catalog, often seen in ransomware attacks.
Detects a sequence of actions often performed by the LCRYX ransomware, characterized by the suppression of Windows boot recovery settings via BCDEdit followed by the deletion of volume shadow copies (using vssadmin or wmic) or backup catalogs (using wbadmin), all executed from the same process within a 10-minute window.
Detects the use of built-in Windows utilities (vssadmin, wmic, wbadmin) to delete shadow copies or backup catalogs. This activity is commonly associated with ransomware and data destruction attacks aiming to inhibit system recovery.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
This rule detects the coordinated execution of multiple Windows command-line utilities (vssadmin, wbadmin, and bcdedit) within a short time frame (60 seconds). These tools are frequently used by ransomware and other malware to delete volume shadow copies, clear backup catalogs, and disable system recovery features, effectively preventing the restoration of the system after a damaging event.
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
Detects evidence of final-stage PayoutsKing or 3AM ransomware deployment by identifying the execution of shadow copy or backup catalog deletion commands on a host where the QEMU virtualization process is simultaneously active, indicative of ransomware activity following lateral movement via VM-based techniques.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects multiple execution attempts of common Windows built-in utilities (bcdedit, vssadmin, wbadmin, wmic) used to disable recovery features or delete volume shadow copies within a 5-minute window. This behavior is highly characteristic of ransomware or destructive malware aiming to prevent system recovery.
Detects execution of Windows utilities used by the TrymeLocker ransomware to inhibit system recovery, including disabling boot recovery features via bcdedit, clearing backup catalogs via wbadmin, deleting volume shadow copies via vssadmin or wmic, and disabling the Windows Recovery Environment via reagentc.
Detects multiple concurrent attempts to inhibit Windows system recovery, a common behavior observed in the TrymeLocker ransomware family. The rule triggers when at least two distinct malicious activities occur on the same host within a 120-second window, including the disabling of the Windows Recovery Environment (WinRE) via bcdedit, deletion of shadow copies via vssadmin or wmic, disabling of the Windows backup service (wbengine) via sc, or disabling of System Restore via registry modification.
This rule detects the use of native Windows utilities to inhibit system recovery capabilities. It monitors for the execution of 'wbadmin.exe' to delete the backup catalog and 'bcdedit.exe' to disable automatic boot recovery or ignore boot failures, which are common tactics used by ransomware and other malware to prevent system restoration after data destruction.
Page 12 of 28