Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects attempts to delete volume shadow copies using 'vssadmin' or 'wmic shadowcopy' commands. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially during ransomware attacks or data destruction efforts.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
Detects attempts to disable Windows Defender features, including real-time, behavior, and script scanning monitoring, as well as modifications to the 'DisableAntiSpyware' registry key, disabling system recovery via bcdedit, or execution of common scripts used to disable Windows Defender.
Detects indicators of Akira ransomware activity, including execution of the binary, dropping of ransom notes, renaming of files with .akira extension, and the use of vssadmin to delete volume shadow copies.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects the use of administrative utilities such as vssadmin.exe, wmic.exe, and wbadmin.exe to delete volume shadow copies or backup catalogs. This behavior is a common indicator of ransomware attempting to inhibit system recovery prior to encryption.
Detects the execution of known Windows utilities (vssadmin, wmic, wbadmin) used to delete Volume Shadow Copies or the backup catalog, a common technique employed by ransomware to prevent system recovery. It also detects processes named locker.exe, commonly associated with ransomware binaries.
Detects Akira ransomware deployment by monitoring the execution of suspected binary files (n.exe or locker.exe) from the C:\ProgramData directory, correlated with system recovery inhibition commands (e.g., vssadmin, wmic, bcdedit) executed on the same host within a 2-hour timeframe.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. This behavior is a common indicator of ransomware activity aimed at preventing system recovery.
Detects the use of vssadmin.exe or wmic.exe to delete Volume Shadow Copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Detects the successful removal of Azure Resource Management locks. Attackers may attempt to delete these locks to modify, move, or delete protected resources that would otherwise be restricted, often as a precursor to data destruction or infrastructure tampering.
Detects the successful removal of Azure Resource Management locks. Attackers may attempt to delete these locks to modify, move, or delete protected resources that would otherwise be restricted, often as a precursor to data destruction or infrastructure tampering.
Detects the execution of native Windows utilities (vssadmin, wbadmin, bcdedit, diskshadow) configured to delete volume shadow copies, remove backup catalogs, or disable automatic recovery features. This activity is a common indicator of ransomware preparation to prevent data recovery.
This rule detects activities aimed at inhibiting system recovery by identifying attempts to delete volume shadow copies via vssadmin, wmic, or powershell, in combination with disabling windows recovery mode using bcdedit. This behavior is indicative of ransomware preparation, where an adversary attempts to prevent the restoration of data before encryption.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.
Detects deletion of VSS copies preventing ransomware recovery
Page 13 of 28