Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
27
13
7
5
2
Contributors
17
12
5
5
4
Categories
32
24
21
5
5
Platforms
32
11
7
4
2
Products / Services
13
9
7
6
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
4
1
IDS Protocols
4
1
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system.
Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging.
Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging.
Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
The following analytic detects the execution of the SysReq hack to reboot a Linux system host. It leverages Endpoint Detection and Response (EDR) data to identify processes executing the command to pipe 'b' to /proc/sysrq-trigger. This activity is significant as it is an uncommon method to reboot a system and was observed in the Awfulshred malware wiper. If confirmed malicious, this technique could indicate the presence of suspicious processes and potential system compromise, leading to unauthorized reboots and disruption of services.
Detects host-control and management tasks (e.g., shutdown, logoff, scheduled task modification) executed as child processes of the msedge_proxy.exe process. This behavior is indicative of the BotHelper malware implant managing infected endpoints.
The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to force an immediate reboot (/r /t 0 /f). This behavior is often associated with disruptive activities or attempts to clear system state by unauthorized actors.
Detects the modification of a Windows Registry Run key using reg.exe to schedule a forced system shutdown. This pattern is often associated with wipers or disruptive malware attempting to ensure system unavailability upon reboot or login.
Detects the execution of the Windows shutdown utility with arguments to force an immediate system reboot. This behavior is commonly observed during the final stages of ransomware attacks, such as NoEscape, to force the system into a state where encrypted files are finalized or to disrupt user access.
Detects the restart of an Azure Container Instance via the Microsoft.ContainerInstance/containerGroups/restart/action operation. This could indicate an attempt to disrupt service availability or potentially hide malicious modifications made to a container by forcing a state change.
Detects the use of Microsoft lookalike domains for command and control (C2) communication in the context of wiper malware.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects the execution of forced system shutdown commands (shutdown -s -t 0) initiated via cmd.exe or PowerShell. This behavior is often observed in post-compromise scenarios, including the TonRAT campaign, to disrupt system availability.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to initiate an immediate system shutdown (timer set to 0 seconds). The rule monitors for this command being invoked by common execution engines such as cmd.exe or node.exe, which is often associated with disruptive activity or ransomware attempts.
Detects unexpected system shutdown or reboot commands
This rule detects attempts to execute a system reboot command via a web shell. It specifically looks for the case-insensitive string "reboot" within the HTTP URI of established client-to-server HTTP traffic. This activity is indicative of an attacker who has gained control over a web server and is using a web shell to issue system-level commands, potentially to disrupt services or cover tracks.
This rule detects the execution of a system shutdown command ('shutdown -h now') over an SSH connection. It specifically looks for this string within TCP traffic directed to port 22 (SSH) on the home network, indicating a remote shutdown initiated via SSH.
This rule detects attempts to initiate a remote system shutdown via the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic directed to port 445 (SMB) on the home network. This activity is often associated with malicious behavior, such as ransomware or destructive attacks, aiming to disrupt systems.
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Page 1 of 3