Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
This rule detects potentially malicious activity involving Linux backup software (Acronis) or attempts to modify file permissions (chmod setuid) to elevate privileges. It triggers when backup-related processes are executed by root or when commands indicative of privilege escalation or tampering occur in conjunction with backup-related paths or binaries.
Detects the execution of the Windows Recovery Environment Configuration Tool (REAgentC.exe) with the '/disable' argument. Adversaries may use this command to inhibit system recovery, preventing users from using built-in Windows recovery options during or after a malicious event.
Detects the execution of the Windows Diskpart utility using a script file, as indicated by the /s command-line argument. This behavior is often associated with malicious actors attempting to perform destructive operations such as removing recovery partitions to inhibit system recovery during ransomware attacks.
Detects the execution of reagentc.exe with the /disable command-line argument, which is used to disable the Windows Recovery Environment (WinRE). Adversaries use this technique to inhibit system recovery and prevent users or automated systems from restoring the operating system to a known good state after an attack, such as data destruction or encryption.
Detects a sequence of suspicious activities associated with credential dumping and inhibiting system recovery. The rule tracks when a user account executes multiple commands related to volume shadow copies (vssadmin, rmdir, mklink) or attempts to copy sensitive registry files (SAM, SYSTEM, SECURITY) within a 15-minute window on the same device.
Detects the creation or abuse of Volume Shadow Copies specifically to access the NTDS.dit file or the SYSTEM registry hive, a common technique for offline Active Directory credential dumping.
Detects the creation or abuse of Volume Shadow Copies specifically to access the NTDS.dit file or the SYSTEM registry hive, a common technique for offline Active Directory credential dumping.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable system recovery features. The rule further correlates this activity with preceding mass file activity to identify potential ransomware or destructive attack behavior.
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'safeboot' mode with networking enabled. Adversaries may use this to bypass security controls that only run in normal boot mode or to facilitate persistent access with minimal system interference.
Detects the use of bcdedit.exe to modify the boot configuration to enable Safe Mode with Networking. This is often used by adversaries to bypass security controls or to prepare a system for activities while in a state where many security products may not load or function.
Detects attempts to delete Volume Shadow Copies using native Windows administrative tools such as wmic.exe and vssadmin.exe. This activity is frequently associated with ransomware, as adversaries often delete local backups to prevent data recovery.
This rule detects processes that load the 'rstrtmgr.dll' library and subsequently perform mass process termination (3 or more distinct processes in under 2 minutes, excluding 'explorer.exe'). This behavior is commonly associated with ransomware, such as DragonForce, which uses the Windows Restart Manager API to identify and forcefully close applications that are locking files they intend to encrypt.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
Detects the execution of the 'reagentc.exe' utility with the '/disable' argument. This command is used to disable the Windows Recovery Environment (WinRE), which is a common post-compromise activity performed by ransomware and other malware to prevent system recovery and hinder incident response efforts.
Detects the execution of 'reagentc.exe' with the '/disable' flag, which is used to disable the Windows Recovery Environment (WinRE). Adversaries often perform this action as part of an attempt to inhibit system recovery during ransomware operations or other destructive attacks.
Detects the execution of the Windows Recovery Environment (WinRE) management tool, reagentc.exe, with the '/disable' flag. This action disables the built-in system recovery features, which is a common tactic used by adversaries to prevent system restoration after data destruction or ransomware attacks.
Detects unauthorized attempts to modify, delete, or truncate backup configuration files and data directories associated with cPanel, WHM, and Plesk environments. This rule monitors for common file manipulation commands (e.g., rm, mv, truncate) targeting sensitive paths like /etc/acronis, /etc/cpanel/backups, and other backup-related directories, excluding actions performed by authorized service accounts.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
Detects the ScreenConnect remote access binary spawning suspicious child processes often associated with lateral movement, system reconnaissance, or anti-forensics activity (such as deleting shadow copies, modifying boot configuration, or using administrative tools for remote command execution). This behavior is highly indicative of an adversary abusing legitimate RMM software to execute post-exploitation commands.
Detects the use of native Windows utilities (vssadmin, wbadmin, bcdedit, wmic) to delete volume shadow copies, backup catalogs, or disable system recovery features. This behavior is a common precursor to or component of ransomware encryption operations intended to prevent system recovery.
Detects the execution of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin) used by the Monkey ransomware C++ variant to delete volume shadow copies, clear the backup catalog, and disable system recovery boot policies. This activity is a characteristic precursor to data encryption.
Page 5 of 28