Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
27
13
7
5
2
Contributors
17
12
5
5
4
Categories
32
24
21
5
5
Platforms
32
11
7
4
2
Products / Services
13
9
7
6
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
1
IDS Protocols
4
1
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detect a system being shutdown or put into different boot mode
This rule detects specific command-line patterns associated with Snatch ransomware activity. Specifically, it looks for commands that immediately reboot the system into safe mode ('shutdown /r /f /t 00') and commands that stop the 'SuperBackupMan' service ('net stop SuperBackupMan'). These actions are characteristic of Snatch ransomware's evasion and impact tactics, where it reboots into safe mode to bypass security software and stops backup-related services to facilitate encryption.
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system. Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging. Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. The rule specifically looks for `pkill -9 vmx-*` or `esxcli` commands used to kill VM processes.
The following analytic identifies the execution of the Windows shutdown command via the command line interface. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because attackers may use the shutdown command to erase tracks, cause disruption, or ensure changes take effect after installing backdoors. If confirmed malicious, this activity could lead to system downtime, denial of service, or evasion of security tools, impacting the overall security posture of the network.
The analytic identifies the execution of the Windows command line to reboot a host machine using "shutdown.exe" with specific parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it is often associated with advanced persistent threats (APTs) and remote access trojans (RATs) like dcrat, which may use system reboots to disrupt operations, aid in system destruction, or inhibit recovery. If confirmed malicious, this could lead to system downtime, data loss, or hindered incident response efforts.
Use of the commandline to shutdown or reboot windows
Detects Silence EmpireDNSAgent as described in the Group-IP report
Use of the commandline to shutdown or reboot windows
Detects the rare use of the command line tool shutdown to logoff a user
Detects the rare use of the command line tool shutdown to logoff a user
'This detection uses Sysmon telemetry to detect System Shutdown/Reboot (MITRE Technique: T1529)'
'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'
This query calculates device uptime based on periodic DeviceInfo which is recorded every 15 minutes regardless of device's network connectivity and uploaded once device gets online. If its interval is over 16 minutes, we can consider device is turned off.Calculated uptime may include up to 30 minutes gap. Devices may be turned on up to 15 minutes earlier than the "timestamp", and may be turned off up to 15 minutes later than the "LastTimestamp". When the single independent DeviceInfo without any sequential DeviceInfo within 16 minutes before or after is recorded, "DurationAtLeast" will be displayed as "00.00:00:00".
This query checks alerts related to file backup deletion and enriches with additional alert evidence information
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects the execution of the "esxcli" command with the "vm" and "kill" flags, indicating an attempt to terminate or shut down a specific virtual machine on an ESXi hypervisor. This activity can be indicative of malicious actions such as ransomware attacks targeting virtualized environments.
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
The following analytic detects the execution of the Windows command line to log off a host machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes involving `shutdown.exe` with specific parameters. This activity is significant as it is often associated with Advanced Persistent Threats (APTs) and Remote Access Trojans (RATs) like dcrat, which use this technique to disrupt operations, aid in system destruction, or inhibit recovery. If confirmed malicious, this could lead to system downtime, data loss, or hindered incident response efforts.
This detection identifies when an administrator manually triggers device management configuration policy sync events, on-demand remediation scripts, or remotely restarts devices within Microsoft Intune. While this functionality can be used legitimately to expedite policy delivery, it can also be abused by an attacker to quickly deploy malicious payloads or disrupt systems.
Page 2 of 3