Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects the deletion or renaming of critical Windows forensic artifacts (pagefile.sys, hiberfil.sys, swapfile.sys) typically performed by the TOKYOCORE wiper to impede forensic analysis and system recovery.
Tier 5 catch-all: flags files exhibiting a broad spread of TOKYOCORE-related strings across identity, C2, ransom-note/branding, destructive, file-operation, data-theft, and persistence clusters, regardless of which specific cluster dominates
Generic rule content from file: TOKYOCORE Wiper: Raw MBR Overwrite via \\.\PhysicalDrive0
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
This rule detects attempts to interact with the Win32_ShadowCopy WMI class using command lines or event logs that indicate deletion or query activity (e.g., DeleteInstance, ExecQuery, SELECT). This is a common technique used by ransomware to inhibit system recovery by deleting volume shadow copies.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the use of built-in Windows utilities, specifically 'wmic.exe' and 'vssadmin.exe', to delete volume shadow copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
This rule detects activities characteristic of the 'Gentleman' ransomware, including the creation of a specific ransom note file ('README-GENTLEMAN.txt'), attempts to tamper with Windows Defender security preferences, and the destruction of system recovery artifacts such as Volume Shadow Copies and various system logs/prefetch files.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects attempts to inhibit system recovery by deleting Volume Shadow Copies using native Windows utilities (vssadmin, wmic, diskshadow) or modifying boot configuration to disable recovery settings (bcdedit), as well as unauthorized modifications to the FilesNotToSnapshot registry key.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects the use of legitimate Windows tools, bcdedit.exe and reagentc.exe, to disable system recovery mechanisms (boot status policies and the Windows Recovery Environment). This activity is often observed during destructive wiper attacks to prevent system restoration after data destruction.
Detects the modification of Windows Registry keys used to disable System Restore functionality, which can be an indication of an adversary attempting to inhibit system recovery.
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
Page 9 of 28