Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
Detects the execution of PowerShell or Command Prompt initiated by Windows script interpreters (wscript.exe, cscript.exe) that contain command-line arguments indicative of malicious activity. This includes commands related to raw disk access, system recovery inhibition (e.g., shadow copy or backup catalog deletion), and boot configuration manipulation often associated with ransomware or wiper activity.
Detects instances where VBScript or JScript engines (wscript.exe, cscript.exe) spawn PowerShell or BCDedit processes. The rule specifically monitors for activities related to disk tampering (e.g., physical drive access or File I/O) and the suppression of Windows recovery features via bcdedit, which are common tactics used by ransomware and destructive malware to disable system backups and prevent remediation.
Detects the execution of Windows system recovery manipulation commands (vssadmin, wbadmin, or bcdedit) initiated by script interpreters (wscript.exe, cscript.exe). This pattern is commonly observed in malware and ransomware campaigns attempting to prevent system recovery.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects the execution of Windows recovery-inhibiting commands (shadow copy deletion, backup catalog deletion, and boot recovery policy modification) originating from wscript.exe, a behavior commonly associated with the LCRYX ransomware family.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.
Detects the use of legitimate Windows system utilities (vssadmin, wmic, bcdedit, wbadmin) to disable recovery mechanisms, such as deleting shadow copies or modifying boot configuration. This behavior is commonly associated with ransomware attempting to prevent system restoration.
This rule detects attempts to create symbolic links, junctions, or reparse points that target Microsoft Defender directories such as quarantine, platform, or scan paths. Adversaries may use these techniques to interfere with security tools, evade detection, or manipulate how Defender processes files.
This rule detects the use of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin, PowerShell) to disable or delete system recovery features, such as volume shadow copies, backup catalogs, or boot recovery options. These actions are common indicators of malicious activity, particularly ransomware, where an attacker attempts to prevent system recovery before data encryption or destruction.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Detects the use of native Windows utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe, and diskshadow.exe) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to inhibit system recovery, a common behavior observed in ransomware attacks.
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule monitors for the execution of Windows utilities (vssadmin, wmic, diskshadow, wbadmin, bcdedit) with command-line arguments associated with deleting shadow copies or disabling system recovery features. This behavior is commonly observed in ransomware attacks to prevent system restoration.
This rule detects the execution of multiple commands commonly used by adversaries to inhibit system recovery, often seen in ransomware attacks. Specifically, it looks for the use of 'vssadmin delete shadows', 'wbadmin delete catalog', 'bcdedit /set', or 'diskpart' in conjunction with '/quiet' or '/force' parameters, and triggers if two or more such commands are executed within an hour on the same computer by the same user.
This rule detects the execution of multiple commands commonly used by adversaries to inhibit system recovery, often seen in ransomware attacks. Specifically, it looks for the use of 'vssadmin delete shadows', 'wbadmin delete catalog', 'bcdedit /set', or 'diskpart' in conjunction with '/quiet' or '/force' parameters, and triggers if two or more such commands are executed within an hour on the same computer by the same user.
Detects attempts to delete volume shadow copies using 'vssadmin' or 'wmic shadowcopy' commands. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially during ransomware attacks or data destruction efforts.
Page 17 of 28