Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Modifications to a config that will serve an adversary's impacts or persistence
Detects Cephalus ransomware behavior, specifically the deletion of Volume Shadow Copies and tampering with Windows Defender settings, which are common precursor activities to encryption.
Detects a process exhibiting multiple behaviors associated with Warlock ransomware. This rule correlates the termination of critical services, deletion of volume shadow copies within a short time window.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
This analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
This rule detects activity associated with the WannaCry ransomware. It specifically looks for the creation of processes with image names commonly used by WannaCry variants (e.g., 'tasksche.exe', 'mssecsvc.exe', 'WanaDecryptor' in the image path) or command lines containing the WannaCry ransom note filename ('@Please_Read_Me@.txt').
Detects aggressive process and service termination using taskkill.exe and sc.exe, a technique characteristic of FunkLocker ransomware.
This rule detects the loading of the 'vssapi.dll' library by executables that are not commonly associated with legitimate Volume Shadow Copy operations. Adversaries often interact with Volume Shadow Copy Service (VSS) DLLs to delete shadow copies, which is a common technique to inhibit system recovery and prevent data restoration after ransomware attacks or data destruction.
Detects the image load of 'vsstrace.dll' by executables that are not typically associated with legitimate Windows operations or known backup solutions. This behavior can indicate an adversary attempting to manipulate or delete Volume Shadow Copies, often as a precursor to data encryption for impact (ransomware) or to hinder system recovery.
Detects Chaos C++ ransomware payloads based on known file hashes and unique embedded strings from the malware.
This rule detects the use of the vssadmin.exe command-line tool to delete volume shadow copies. This is a common and high-confidence technique used by ransomware and other malicious actors to prevent system recovery and increase their leverage.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
This rule detects the Warlock ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include code responsible for encrypting files, killing processes, stopping services, and discovering drives, which are common behaviors of ransomware.
KQL Query
Detects the execution of multiple commands commonly used by Dire Wolf ransomware to delete backups, shadow copies, and event logs, thereby inhibiting system recovery. The rule triggers when more than one of these anti-recovery commands are executed on the same host within a 10-minute window, distinguishing malicious patterns from isolated, legitimate administrative actions.
Detects scenarios where an attacker attempts to delete existing VSS backup.
Detects scenarios where an attacker attempts to delete or resize existing VSS backup.
Detects scenarios where an attacker attempts to delete existing Windows native backup (only available on Windows Server).
Detects scenarios where an attacker attempts to delete existing Windows native backup by reducing the allocated backup storage.
Delete Shadow Copy Via Powershell
Page 20 of 28