Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. Specifically, it looks for commands that disable boot status policy to ignore all failures and disable recovery enabled.
Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).
Detects modifications to the Windows Registry that disable the System Restore functionality. This is achieved by setting specific registry values ('DisableConfig' or 'DisableSR') to '1' (DWORD 0x00000001) within the System Restore related registry paths.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
This rule detects when an Nginx worker process crashes and generates a core dump, indicated by the log message 'exited on signal 6 (core dumped)'. This event can signify a serious underlying problem with the Nginx configuration, a plugin, or potentially an exploitation attempt targeting the Nginx server. Core dumps contain the memory state of the process at the time of the crash, which can be valuable for debugging but also sensitive if exposed.
This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Detects when the 'firmwarepasswd' utility is executed on macOS with commands to set, delete, or check the firmware password. This activity can indicate an attempt to manipulate the system's firmware security settings, potentially for malicious purposes such as preventing unauthorized OS installations or recovery, or to lock out legitimate users. The rule notes that this command is disabled on Apple Silicon-based Macs.
This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.
Identifies when an Azure Application Security Group is modified or deleted. This could indicate an attempt to alter network access controls, potentially to bypass security measures or disrupt services.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
This rule detects command-line parameters and strings commonly associated with cryptocurrency mining software, specifically targeting Monero miners like XMRig. It looks for specific arguments such as CPU priority settings, donation levels, pool addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), algorithm specifications ('--algo=rx/0'), and base64 encoded versions of these strings. It also includes a specific command for loading the 'msr' kernel module, which can be used by miners to optimize performance.
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
Page 124 of 149