Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the presence of XMRig cryptocurrency miner ELF binaries by scanning for unique structural strings and configuration flags indicative of XMRig operations. This rule uses YARA to inspect binary file contents, enabling detection of miners regardless of their on-disk filename or obfuscation techniques such as hiding them within dotfiles.
This rule detects potential ransomware activity by monitoring for a high volume (more than 10) of file creation or renaming events within a short timeframe (30 minutes) initiated by a process named 'htspnew.exe'. It excludes common system and temporary directories to reduce noise, focusing on suspicious file modifications that might indicate bulk encryption or mass file manipulation.
This rule detects potential ransomware activity by monitoring for a high volume (more than 10) of file creation or renaming events within a short timeframe (30 minutes) initiated by a process named 'htspnew.exe'. It excludes common system and temporary directories to reduce noise, focusing on suspicious file modifications that might indicate bulk encryption or mass file manipulation.
This rule detects potential ransomware activity by monitoring for a high volume (more than 10) of file creation or renaming events within a short timeframe (30 minutes) initiated by a process named 'htspnew.exe'. It excludes common system and temporary directories to reduce noise, focusing on suspicious file modifications that might indicate bulk encryption or mass file manipulation.
This rule detects potential ransomware activity by monitoring for a high volume (more than 10) of file creation or renaming events within a short timeframe (30 minutes) initiated by a process named 'htspnew.exe'. It excludes common system and temporary directories to reduce noise, focusing on suspicious file modifications that might indicate bulk encryption or mass file manipulation.
This rule detects potential ransomware activity by monitoring for a high volume (more than 10) of file creation or renaming events within a short timeframe (30 minutes) initiated by a process named 'htspnew.exe'. It excludes common system and temporary directories to reduce noise, focusing on suspicious file modifications that might indicate bulk encryption or mass file manipulation.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects potential Business Email Compromise (BEC) attempts where an attacker impersonates an executive (CEO, CFO, etc.) via email. It identifies emails where the Sender's display name suggests a high-level executive role, but the domain of the Reply-To address differs from the sender domain, which is a common indicator of a fraudulent routing attempt. The rule further narrows this down to emails with subject lines typical of financial-themed urgency or requests.
Detects the loading of rstrtmgr.dll by processes other than known Windows installers, update services, or explorers. The Restart Manager API is often abused by ransomware to terminate processes holding file locks, facilitating the encryption of files that would otherwise be in use.
Detects files containing specific structural footers (537 bytes) and RSA key generation strings commonly associated with ransomware encryption. The footer indicates the use of RSA-4096 to encrypt files, with modes for full, striped, or header-only encryption patterns.
Detects mass file renaming activity associated with OpnKey ransomware, which appends specific ransom identifiers to files. This behavior is indicative of the encryption phase of a ransomware attack, where files are renamed to reflect the encryption status or to include a unique victim identifier.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects the loading or presence of the Alinubx.sys kernel driver, a malicious component used for Bring Your Own Vulnerable Driver (BYOVD) attacks. This driver facilitates the mass termination of security product processes (AV/EDR) by exposing a specific IOCTL (0x222024) to interface with kernel-mode process termination primitives (e.g., ZwTerminateProcess), often serving as a precursor to the deployment of stealers like Rapuncel.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
This rule monitors for potential suspicious database operations executed via MySQL command-line utilities. It specifically detects the use of the AES_ENCRYPT function in conjunction with UPDATE statements, which is a technique often used by ransomware to encrypt database tables or data.
Page 23 of 149