Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Run from a Zip File
Sigma
Payloads may be compressed, archived, or encrypted in order to avoid detection
Detects a specific command used by the Conti ransomware group
Detects command line patterns used by BlackByte ransomware in different operations
Detects potential Dtrack RAT activity via specific process patterns
Detects LockerGoga ransomware activity via specific command line.
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
Detects the recovery of files from backups via "wbadmin.exe".
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.
Detects the stopping of a Windows service via the "sc.exe" utility
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Detects the deletion of backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects the use of SDelete to erase a file not the free space
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.
Shadow Copies deletion using operating systems utilities
Detects the deletion of all backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects the modification of the registry to disable a system restore on the computer
Detects the image load of vss_ps.dll by uncommon executables
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects the image load of VSS DLL by uncommon executables
Page 110 of 149