Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the use of the built-in Windows utility 'cipher.exe' with the '/w:' argument to overwrite deleted data on disk. This technique is often used by adversaries to destroy data and files, making them irrecoverable by forensic methods, thereby impacting system availability.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
This rule detects suspicious invocations of the `fsutil.exe` utility, specifically when it's used to delete the USN journal, create a USN journal with a small size, or set zero data to a file. These actions are often associated with ransomware or other malicious activity aimed at defense evasion and data destruction, as seen in campaigns like NotPetya and Lockbit.
Detects a command that accesses the Volume Shadow Copy to extract sensitive files such as the Security or SAM registry hives or the Active Directory database (ntds.dit). This activity is often associated with credential dumping.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the usage of 'schtasks.exe' with the '/delete' flag and the '/tn *' argument, which is used to delete all scheduled tasks on a local Windows system, including those created by other users. This activity can be indicative of an adversary attempting to disrupt system operations or remove forensic evidence.
Detects the execution of Sysinternals SDelete to overwrite a specific file, rather than its intended use of wiping free space or entire volumes. This activity is indicative of an adversary attempting to destroy data to prevent recovery or forensic analysis.
Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Detects the execution of the built-in 'copy' command targeting a Volume Shadow Copy. This technique is often used by adversaries to exfiltrate sensitive files, such as registry hives, that are actively in use and locked by the operating system. By copying from a shadow copy, adversaries can bypass file locks and access system-critical data.
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt by adversaries to bypass parent/child relationship detection or application whitelisting rules by using Diskshadow.exe to proxy execution of other binaries like certutil.exe, powershell.exe, or rundll32.exe. This technique is often used for defense evasion and can be part of credential access or data exfiltration attempts.
Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
Detects the execution of the 'gpg.exe' utility when its filename has been changed. Adversaries, particularly ransomware and loaders, often rename legitimate tools like GnuPG to evade detection while using them for encryption or decryption operations.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
Identifies when a DNS Zone is modified or deleted in Google Cloud.
Identifies when a application gateway is modified or deleted.
Identifies when a application security group is modified or deleted.
Detects when storage bucket is modified or deleted in Google Cloud.
Page 127 of 149