Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.
Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects a Denial of Service (DoS) activity in an Amazon EC2 instance.
Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
Detect when multiple GCP Service APIs are disabled in a short period of time.
Detects exploitation attempts of CVE-2024-49113, known as LDAP Nightmare. This rule specifically looks for "Application Error" events (EventID 1000) where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". This combination indicates a crash in the Local Security Authority Subsystem Service (LSASS) related to the Windows Lightweight Directory Access Protocol (LDAP) client library, which is consistent with the described vulnerability exploitation.
Yara rule that detects Helldown ransomware.
This rule detects highly relevant antivirus events in the Windows Application log by looking for specific keywords associated with known virus signatures, malware, and offensive security tools. It aims to identify instances where an antivirus product has detected or quarantined malicious software or activity.
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
This Yara rule detects the CyberVolk ransomware by identifying specific byte patterns within its 'manage_gui', 'find_files', and 'encrypt_files' functions. The rule looks for two distinct versions of the 'find_files' and 'encrypt_files' functions, indicating variations in the ransomware's implementation. The presence of these patterns suggests the file is a CyberVolk ransomware executable.
Yara rule that detects CyberVolk ransomware.
Detects suspicious DNS queries to known Monero mining pools, indicating potential cryptocurrency mining activity on the network. This rule identifies specific domain names associated with various Monero mining operations.
Detects suspicious DNS queries to Monero mining pools
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
This rule detects when the 'RstrtMgr.dll' (Restart Manager) library is loaded by a process that is not part of the common legitimate Windows processes or typical software installation paths. Adversaries, particularly ransomware and wiper malware, have been observed using this DLL to terminate processes that might interfere with their operations, such as file encryption or data destruction. This can include killing processes that lock files, preventing encryption, or for anti-analysis purposes.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Yara rule that detects Cicada3301 ransomware.
Detects when AWS S3 bucket versioning is disabled. This action can be a precursor to data deletion or modification without the ability to recover previous versions, often seen in ransomware attacks targeting cloud storage.
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities. This rule specifically looks for `schtasks.exe` being used with the `/Change`, `/TN`, and `/disable` arguments, targeting important system tasks like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate.
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
Detects suspicious modifications to sensitive or critical system files on Linux systems. This rule monitors for common command-line utilities (like 'cat', 'echo', 'grep', 'vi', 'nano', 'sed') being used with output redirection ('>') or directly to edit files within critical system directories and configuration files. This activity could indicate an attacker attempting to alter system behavior, maintain persistence, or escalate privileges by modifying files that are not expected to change without explicit administrative planning.
Page 122 of 149