Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects the hallmark Nightspire pre-encryption routine: executing vssadmin.exe or wmic.exe to quietly delete Volume Shadow Copies, preventing host restoration.
Detects BQTLock ransomware anti-analysis checks, specifically looking for processes named 'start.exe' or 'BQT.exe' that exhibit characteristics of PyInstaller environments (via environment variables) or log anti-debugging failure messages. This rule helps identify the initial stages of BQTLock execution where it attempts to evade analysis.
Detects attempts by GreenBlood ransomware or similar threats to delete Volume Shadow Copies and Windows Backup catalogs using 'wmic.exe', 'vssadmin.exe', and 'wbadmin.exe' with specific command-line arguments. This activity is typically performed to prevent system recovery and data restoration.
Detects the creation of a file named '__RestoreYourFiles__.txt' within the Microsoft Word STARTUP folder. This file name and location are commonly associated with ransomware activity, specifically the BlackByte ransomware, which drops this file as a ransom note.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.
Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.
Detects abnormal execution of Virtual Disk Service (vds.exe, vdsldr.exe) or Windows Backup Engine (wbengine.exe) processes. This activity is often abused by Makop ransomware to hinder system recovery by deleting backups or shadow copies. The rule specifically looks for these executables being initiated by processes other than svchost.exe, services.exe, or vds.exe, which are legitimate initiators.
Identifies Nightspire utilizing bcdedit.exe to modify boot configuration data, explicitly ignoring all boot failures and disabling the Windows recovery environment.
Correlates the SimpleHelp RMM execution with vssadmin.exe commands designed to delete shadow copies prior to ransomware deployment.
Detects the deletion of volume shadow copies via vssadmin or wmic, removal of the Windows backup catalog using wbadmin, and the disabling of system recovery boot settings via bcdedit. This activity is consistent with pre-encryption preparation behavior observed in Akira ransomware attacks.
Detects coordinated activity characteristic of Akira ransomware, involving the inhibition of system recovery mechanisms (shadow copy deletion, backup catalog deletion, recovery policy modification) followed by high-volume file renaming (indicative of file encryption) across multiple host systems within a short timeframe.
Identifies the Go payload using bcdedit to disable automatic startup recovery and ignore boot failures, which is a common technique used by ransomware to prevent system recovery.
Detects the use of built-in Windows utilities (vssadmin, wmic, wbadmin) to delete shadow copies or backup catalogs. This activity is commonly associated with ransomware and data destruction attacks aiming to inhibit system recovery.
Detects the use of native Windows utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe, and diskshadow.exe) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to inhibit system recovery, a common behavior observed in ransomware attacks.
Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.
Page 15 of 28