Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects the execution of built-in Windows utilities such as ntdsutil.exe, vssadmin.exe, and diskshadow.exe, often used by attackers to dump the Active Directory database (NTDS.dit) or manipulate volume shadow copies for credential theft or data staging/destruction purposes.
Detects the use of legitimate Windows tools (wbadmin.exe and bcdedit.exe) to inhibit system recovery by deleting backup catalogs or disabling automatic Windows recovery features. This behavior is commonly associated with ransomware strains like Pay2Key to ensure that backups cannot be used to restore encrypted data.
Detects the execution of PowerShell commands intended to suspend BitLocker protection on system volumes. This behavior is indicative of VILE ransomware attempting to disable volume encryption to facilitate further malicious activity or file encryption.
Detects unauthorized or suspicious use of virtualization management tools (e.g., esxcli, vim-cmd, PowerShell cmdlets for vSphere/Hyper-V) to perform disruptive actions such as powering off VMs, removing snapshots, or modifying firewall configurations. The rule excludes activity originating from standard management processes and trusted VMware/Microsoft signed processes.
Detects unauthorized or suspicious use of virtualization management tools (e.g., esxcli, vim-cmd, PowerShell cmdlets for vSphere/Hyper-V) to perform disruptive actions such as powering off VMs, removing snapshots, or modifying firewall configurations. The rule excludes activity originating from standard management processes and trusted VMware/Microsoft signed processes.
Detects the deletion of local shadow copies using vssadmin, WMI, PowerShell, or wbadmin, a common tactic employed by ransomware to prevent system recovery.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects the coordinated execution of multiple Windows command-line utilities (vssadmin, wbadmin, and bcdedit) within a short time frame (60 seconds). These tools are frequently used by ransomware and other malware to delete volume shadow copies, clear backup catalogs, and disable system recovery features, effectively preventing the restoration of the system after a damaging event.
Detects the invocation of vssadmin.exe with command-line arguments to delete all volume shadow copies silently, a common tactic used by ransomware to prevent system recovery.
This rule detects the use of standard Windows administrative utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe) to delete system backups, shadow copies, or disable recovery options. It specifically monitors for these commands when executed by suspicious parent processes or shells, which is a common tactic used by ransomware to prevent system restoration after encryption.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, wbadmin, diskshadow) and PowerShell to delete Volume Shadow Copies or disable system recovery features. These activities are commonly used by ransomware to prevent easy restoration of encrypted data.
This rule detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, diskshadow) to inhibit system recovery by deleting volume shadow copies or modifying boot configurations to prevent automated system repair.
This rule detects a suspicious process execution chain where 'start.exe' or 'BQT.exe' is identified in a parent-child relationship. Specifically, it flags 'start.exe' spawning 'BQT.exe', or 'BQT.exe' subsequently invoking 'vssadmin.exe' with the 'delete shadows' command, which is a common technique used by ransomware to prevent system recovery.
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Detects the use of built-in Windows utilities (vssadmin, wbadmin, bcdedit) to delete volume shadow copies, clear backup catalogs, or modify boot configuration settings to disable recovery features, which is a common precursor to ransomware encryption.
This rule detects the execution of 'REAGENTC.EXE' with the '/disable' argument and 'WBADMIN.EXE' with 'delete catalog -quiet' within a 10-minute window on the same device. This combination of commands is indicative of an adversary attempting to inhibit system recovery by disabling Windows Recovery Environment and deleting the Windows Backup Catalog, often seen in ransomware attacks.
Detects the deletion of volume shadow copies using standard Windows utilities like vssadmin.exe or wmic.exe, combined with concurrent file activity in multiple directories, a behavior frequently observed during the impact phase of a ransomware attack (specifically associated with the Qilin ransomware family).
Detects the deletion of volume shadow copies using standard Windows utilities like vssadmin.exe or wmic.exe, combined with concurrent file activity in multiple directories, a behavior frequently observed during the impact phase of a ransomware attack (specifically associated with the Qilin ransomware family).
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Page 14 of 28