Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects the use of vssadmin.exe or wmic.exe to delete Volume Shadow Copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Detects attempts to delete Volume Shadow Copies (VSS) using 'vssadmin' or 'wmic' commands, especially when these commands are executed by unusual parent processes. This activity is a common tactic used by ransomware, such as Qilin, to prevent system recovery.
Shadow Delete Activity
YARA-L
Detects attempts to delete shadow copies or disable system recovery using common administrative tools.
Detects wallpaper registry modifications using .bmp files, indicative of a ransom note being set by an unusual process. The rule specifically looks for changes to the 'Wallpaper' value or any key containing '\Control Panel\Desktop' in the registry, where the new wallpaper file ends with '.bmp'. It excludes modifications made by common system processes like 'explorer.exe', 'svchost.exe', and 'systemsettings.exe' to reduce false positives.
Detects attempts to delete backup catalogs or shadow copies using wbadmin.exe or vssadmin.exe, common anti-recovery techniques used by Makop ransomware.
This rule detects activities aimed at inhibiting system recovery by identifying attempts to delete volume shadow copies via vssadmin, wmic, or powershell, in combination with disabling windows recovery mode using bcdedit. This behavior is indicative of ransomware preparation, where an adversary attempts to prevent the restoration of data before encryption.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
This rule detects the use of native Windows administration tools (vssadmin, wmic, wbadmin, and bcdedit) to inhibit system recovery. Actions include deleting volume shadow copies, deleting the backup catalog, disabling Windows automatic recovery, or tampering with boot status policies. Such activities are commonly associated with ransomware operations intended to prevent system restoration and increase the impact of data destruction.
Detects the suspicious execution of multiple system recovery inhibition commands (vssadmin.exe, bcdedit.exe, and wbadmin.exe) within a short timeframe (60 seconds) on the same host. This pattern of activity is consistent with the pre-encryption stage of many ransomware attacks, where adversaries attempt to prevent system restoration by deleting shadow copies and backup catalogs, and disabling boot recovery.
Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.
Detects unauthorized deletion, renaming, or movement of system command-line utilities (cmd.exe) located in System32 or SysWOW64, correlated with the use of standard Windows tools to delete Volume Shadow Copies. This behavior is indicative of ransomware preparation to inhibit system recovery and interfere with standard administration tasks.
Detects the execution of Windows native utilities wbadmin.exe to delete system backup catalogs and bcdedit.exe to disable boot recovery features. This combination of commands is a hallmark of Pay2Key ransomware, used to inhibit victim system recovery following encryption.
Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.
Detects attempts to inhibit system recovery by identifying multiple, distinct commands aimed at deleting volume shadow copies, backup catalogs, or disabling boot recovery features (e.g., using vssadmin, wmic, bcdedit, or wbadmin) from the same parent process within a 60-second window, which is common behavior for ransomware strains like TrymeLocker.
Detects the execution of Windows native utilities wbadmin and bcdedit configured to inhibit system recovery, a common behavior observed in ransomware campaigns to prevent data restoration. Specifically, it monitors for the deletion of the Windows Backup catalog and the modification of boot configuration to ignore failure states.
Detects LCRYX ransomware and similar malicious activity involving the deletion of volume shadow copies, backup catalogs, and the disabling of system recovery features using standard Windows administrative utilities such as vssadmin, wbadmin, wmic, and bcdedit.
Page 16 of 28