Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects attempts to delete volume shadow copies using 'vssadmin' or 'wmic shadowcopy' commands. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially during ransomware attacks or data destruction efforts.
Detects registry modifications designed to disable automatic system reboots and scheduled maintenance, preventing the system from interrupting destructive actions, as observed with BLUERABBIT.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
Detects the execution of the Restart-Computer cmdlet with the -Force flag via PowerShell, a technique used by a recent malware dropper to disrupt sandbox analysis.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
Detects exclusive file locks used to prevent security tools from accessing files
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
VSS Shadow Copy Deletion
Cortex XDR
Detects the execution of vssadmin.exe to delete volume shadow copies, a common precursor to ransomware encryption utilized by Payload and other ransomware families. The rule specifically looks for `vssadmin.exe` being executed with the command-line arguments `delete shadows`, `/all`, and `/quiet`, indicating an attempt to silently remove all shadow copies.
This rule detects a TFTP (Trivial File Transfer Protocol) firmware upload attempt where the data size is greater than 10000 bytes. This could indicate an attempt to corrupt or replace the firmware on a device, potentially leading to denial of service or unauthorized control. The rule specifically looks for UDP traffic on port 69 (TFTP) with a specific content pattern and a large data size.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects HTTP requests where the URI contains the string "ransom" (case-insensitive). This pattern is indicative of potential ransomware command and control (C2) check-ins, as ransomware often uses terms like 'ransom' in its communication with C2 servers.
Detects the specific command line arguments used by Payouts King ransomware, specifically requiring the mandatory execution trigger parameter '-i' alongside at least one of the obfuscated behavior flags: '-noelevate', '-nohide', '-nopersist', or '-note'. This combination is highly indicative of Payouts King ransomware execution.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
Detects the specific vssadmin command used by VECT ransomware to silently delete all volume shadow copies. Shadow copy deletion is a critical precursor to ransomware impact, effectively removing localized backup recovery options.
This rule detects attempts to delete volume shadow copies using 'vssadmin.exe' or 'wmic.exe' with specific command-line arguments. This activity is often associated with ransomware or other destructive malware aiming to inhibit system recovery. The rule explicitly excludes commands containing 'backup' to reduce false positives.
Detects the use of esxcfg-advcfg to alter the BufferCache settings (MaxCapacity or FlushInterval) on an ESXi host. This activity is often associated with ransomware variants like Gentlemen ransomware, which modify these settings to prepare the storage layer for fast, reliable bulk file encryption.
Page 18 of 28