Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that delete shadow copies on systems, which can be a defense evasion technique to prevent system recovery. The rule identifies instances where diskshadow.exe is launched with the script execution flag.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag, where the script is located in a potentially suspicious directory such as temporary folders or user application data directories. This behavior is often associated with defense evasion and system recovery inhibition by adversaries.
Detects attempts to disable the Windows Recovery Environment (WinRE) using the `reagentc.exe` command-line tool with the `/disable` argument. Disabling WinRE can prevent system recovery and troubleshooting, which is a common tactic used by adversaries to hinder incident response and recovery efforts.
Detects the execution of "Diskshadow.exe" in script mode with a potentially uncommon script extension. This rule requires initial baselining of allowed script extensions to minimize false positives. Adversaries may use Diskshadow.exe, a legitimate Windows utility, to proxy execution of malicious scripts, often as a defense evasion technique.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
Detects attempts to modify Programmable Logic Controller (PLC) ladder logic or firmware. Such modifications can indicate a high-impact attack aimed at disrupting physical processes, damaging equipment, or establishing persistence within the Operational Technology (OT) network.
Detects attempts to disable windows recovery environment using Reagentc.
ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).
It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.
ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).
It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.
Detects the disabling of the 'execInstalledOnly' kernel setting on an ESXi host, a critical security control that prevents the execution of unsigned binaries. This is often followed by a host reboot to apply the change. This TTP is used by threat groups like UNC3944 to prepare the hypervisor for custom ransomware execution.
Detects the Chaos ransomware encryptor based on unique command-line arguments and embedded strings.
Detects a wide range of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with SafePay ransomware, including specific command lines, persistence mechanisms, defense evasion techniques, and host-based artifacts.
This detection identifies attempts to delete volume shadow copies using common utilities like vssadmin, wmic, or PowerShell. This is a technique frequently used by ransomware before encryption to prevent easy restoration of files.
Detects the suspicious loading of `vss_ps.dll` by executables that are not typically associated with the Volume Shadow Copy Service (VSS). This DLL is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts, commonly seen in ransomware attacks or other destructive operations. The rule filters out known legitimate processes and common program file locations to reduce false positives.
DEVMAN Ransomware Detection
KQL Query
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
Detects WannaCry ransomware activity
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.
Page 21 of 28