Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
This rule detects when critical services, including security agents, backup solutions, and remote management tools, are stopped on a host. Adversaries often stop these services to evade detection, disable security controls, or inhibit system recovery during attacks like ransomware.
Detects the execution of bcdedit.exe to disable the Windows Recovery Environment or ignore boot failures. This is a common pre-encryption technique used by Kyber ransomware to prevent defenders from restoring the OS.
Detects the use of esxcfg-advcfg to alter the BufferCache settings on an ESXi host. This activity can be a precursor to bulk file encryption, as seen with the 'Gentlemen Linux variant' which modifies VMFS write buffer and flush interval to prepare ESXi hosts for fast, reliable encryption.
Shadow Copies deletion using operating systems utilities
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.
Detects the modification of the registry to disable a system restore on the computer
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects recovery inhibition commands used by The Gentlemen including Recycle Bin deletion, RDP log wiping, and Prefetch file removal to prevent forensic investigation and data recovery.
This rule detects attempts to delete shadow copies using built-in Windows utilities such as PowerShell, WMIC, or VSSAdmin. The detection specifically looks for command-line arguments containing 'shadow' and 'delete' when executed by these processes. This activity is commonly associated with ransomware or other destructive malware aiming to prevent system recovery.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
This rule detects the execution of 'REAGENTC.EXE' with the '/disable' argument and 'WBADMIN.EXE' with 'delete catalog -quiet' within a 10-minute window on the same device. This combination of commands is indicative of an adversary attempting to inhibit system recovery by disabling Windows Recovery Environment and deleting the Windows Backup Catalog, often seen in ransomware attacks.
Detects common late-stage ransomware indicators including the deletion of Volume Shadow Copies or the clearing of Windows Event Logs using vssadmin.exe or wevtutil.exe. These are reliable signals of imminent impact.
This rule detects the execution of multiple distinct commands used to inhibit system recovery on a single host within a short time window. This behavior is a strong indicator of ransomware or other destructive malware attempting to prevent system restoration.
Detects the execution of the command to stop the vCenter remote management service (vpxa) on an ESXi host. This is a technique used by the RansomHouse MrAgent tool to inhibit system recovery and impair defenses before deploying the Mario encryptor.
Delete Windows shadow copies before it begins encrypting the data on the victim host. This tactic is typically carried out with powershell, vssadmin or wmic.
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.
Page 19 of 28