Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects potential supply chain or local configuration tampering involving the Model Context Protocol (MCP). The rule identifies modification of common MCP configuration files, followed by the execution of a tool runner (node, python, npx) that spawns a scripting shell, which subsequently initiates an unusual outbound network connection.
Detects the presence of PAYLOAD ransomware ELF binaries specifically configured to target VMware ESXi environments. The detection logic looks for a combination of ELF magic bytes, the 'PAYLOAD' string, references to common virtual machine file extensions (e.g., .vmdk, .vmx), and usage of ESXi-specific administration tools such as esxcli or vim-cmd.
Detects a behavioral pattern characteristic of Everest ransomware, where a sequence of rapid process terminations occurs within a 20-second window. The rule identifies the coordinated termination of security/analysis tools, antivirus/backup/database services, and other high-memory processes on a single device, excluding known legitimate maintenance processes.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects a service principal attempting to delete multiple Azure SQL databases in a short timeframe, resulting in failures. This pattern is characteristic of malicious data destruction activity, such as that observed in Storm-3168 (JADEPUFFER) campaigns, but accounts for the possibility of misconfigured infrastructure-as-code pipelines by requiring a high volume of failed requests across distinct resources.
Detects attempts to delete Azure resource locks protecting Site Recovery or Backup services, followed by credential retrieval (ListKeys) within a one-hour window. This sequence pattern is a strong indicator of an adversary attempting to disable backup protection before potentially destroying data or exfiltrating keys.
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
This rule detects the execution of common Windows administration utilities (vssadmin.exe, wmic.exe, wbadmin.exe, bcdedit.exe) being used to delete Volume Shadow Copies, backup catalogs, or modify boot configuration data to disable automatic recovery. These actions are frequently performed by ransomware to prevent data restoration.
Detects the deletion of Windows Volume Shadow Copies using vssadmin.exe, wmic.exe, or PowerShell (WMI/CIM objects). This activity is commonly used by ransomware to prevent local data recovery by destroying shadow copy backups before encryption.
This rule detects the loading of the 'vsstrace.dll' module by processes that are not standard system processes or authorized software. The 'vsstrace.dll' is a library used by the Volume Shadow Copy Service (VSS). Unauthorized or unexpected processes loading this DLL may indicate an attempt to interact with or manipulate volume shadow copies, which is a common behavior for ransomware attempting to inhibit system recovery.
Detects the creation of a suspicious 'com.apple.finder.agent' plist file within a user LaunchAgents directory followed shortly by the termination of known macOS notification and background management agents. This pattern is often associated with malware attempting to evade detection or manipulate user notifications by disabling system components.
Detects network activity related to the BEAST ransomware targeting VMware ESXi systems. The rule identifies attempts to stage encryption operations via SSH, including detecting references to known filenames ('encryptor.elf', 'beast_esxi') and the use of the 'vim-cmd' utility to power off virtual machines as part of the preparation for file encryption.
Detects high-frequency file deletion events originating from processes with names or command-line indicators associated with AI orchestration frameworks like Semantic Kernel. This behavior may indicate an adversary abusing legitimate AI agent tools to perform unauthorized data destruction.
Detects instances where an identity with no prior compute-provisioning history in the last 14 days successfully provisions high-performance GPU-enabled virtual machines in Azure. This behavior is indicative of potential resource hijacking, such as LLMjacking, where compromised identities are leveraged to deploy infrastructure for unauthorized resource-intensive workloads.
Detects a suspicious volume of cloud resource deletions occurring within a short 15-minute window, specifically targeting multiple storage accounts and SQL database/server instances. This behavior is indicative of a malicious actor or an automated script attempting to disrupt business operations or destroy data.
Detects anomalous bursts of deletion activity targeting Azure Site Recovery and Backup resources, including management locks and backup policies. This behavior is consistent with an adversary attempting to inhibit system recovery capabilities, often a precursor to destructive activities such as ransomware deployment. The rule also correlates this activity with the deletion of other critical infrastructure components like databases or storage accounts.
The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
Detects anomalous, high-volume activity by a single identity involving the provisioning of compute-intensive GPU-based EC2 instances or the bulk invocation of LLM models via AWS Bedrock and SageMaker services within a short timeframe. This behavior may indicate account compromise, resource hijacking for unauthorized AI workloads, or crypto-mining.
Detects the execution of the XMRig cryptominer masquerading as the legitimate systemd-logind service. The rule identifies suspicious command-line arguments indicative of mining activity, or instances where systemd-logind is spawned from unauthorized parent processes such as shell interpreters, container engines, or nsenter, which is often characteristic of post-exploitation activity like privileged Docker container escapes.
Detects the CARBONATO botnet using two distinct persistence and evasion techniques: masquerading user-space processes as kernel worker threads by setting command line arguments to '[kworker/u2:0]', or disguising mining binaries as the systemd-logind service. Legitimate kernel threads are spawned by PID 2 and lack an executable path, while the legitimate systemd-logind is expected to be spawned by systemd/init.
Detects execution of an XMRig cryptominer masquerading as the legitimate system process 'smss.exe' from a non-standard file path. This detection specifically identifies the presence of the WinRing0x64.sys kernel driver, often used by XMRig for hardware MSR access, and detects preceding malicious activity involving UnRAR extraction of the miner using a specific password.
Page 14 of 149