Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects configuration events in BeyondTrust Password Safe where a user is removed from a group containing 'Administrators' in its name. This monitors for potential unauthorized removal of administrative privileges or interference with operational access.
This rule detects the use of native Windows utilities 'vssadmin.exe' and 'wmic.exe' to delete Volume Shadow Copies. This activity is a common tactic used by ransomware and other malicious actors to prevent system recovery by destroying backups, and is classified as Inhibit System Recovery.
This rule detects the use of the 'bcdedit.exe' utility to modify Windows Boot Configuration Data (BCD) settings to disable system recovery features, such as boot recovery or automatic failure handling. Such actions are commonly performed by ransomware or other destructive malware to prevent system restoration after encryption or data damage.
Detects sustained outbound Stratum mining-protocol connections to Monero mining pools from a compromised host (5+ connections within 5 minutes), consistent with post-exploitation cryptomining following Screen Sharing compromise.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Detects HTTP requests for fingerprinted JavaScript/CSS assets shared across UNC6671's cloned SSO and cryptocurrency vault-drainer phishing panels.
This rule detects execution of macOS processes that contain specific strings associated with cryptocurrency wallet-draining malware (e.g., 'DRAIN_PCT', 'DRAIN_FUNCTION'). It monitors process creation command-line arguments to identify attempts by malicious software to execute functions intended to empty victim crypto wallets.
Detects the use of native Windows utilities such as vssadmin, wbadmin, wmic, diskshadow, and bcdedit to delete volume shadow copies, backup catalogs, or modify boot configuration to prevent system recovery. The rule explicitly excludes designated backup servers to reduce noise from legitimate management activities.
This rule detects the use of the Windows native utility 'wbadmin.exe' to delete the backup catalog. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing the ability to restore data from built-in Windows backup utilities.
This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.
Disabled User Monitoring For On-Prem
Cortex XDR
This rule detects Windows Security Event ID 4725, which indicates that a user account has been disabled. It extracts relevant details such as the target user account, domain, and the user who performed the action to provide context for potential account-based denial-of-service or unauthorized access removal attempts.
This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Flags modifications to the Windows hosts file made by an unsigned process or a process freshly dropped in a temp folder within the last 10 minutes, consistent with Abyssos's DNS_ADD/DNS_DEL hosts-file manipulation.
Detects the use of native Windows utilities such as vssadmin, wbadmin, wmic, diskshadow, and bcdedit to delete volume shadow copies, backup catalogs, or modify boot configuration to prevent system recovery. The rule explicitly excludes designated backup servers to reduce noise from legitimate management activities.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects users or applications whose AI API token consumption or spend is sustained above a dynamic baseline across multiple consecutive time buckets rather than a single burst, which may indicate token jacking, credential theft, or abuse of stolen AI API keys via gray-market proxy services.
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
Detects inbound emails masquerading as ServiceNow ticket notifications that solicit sensitive information (e.g., vendor IDs, invoice numbers, bank account details) via reply-only body content. This technique evades traditional SEG scanning by avoiding malicious URLs or attachments and leveraging the reputation of legitimate, though spoofed, ServiceNow infrastructure.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Page 37 of 149