Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
This rule detects attempts to interact with the Win32_ShadowCopy WMI class using command lines or event logs that indicate deletion or query activity (e.g., DeleteInstance, ExecQuery, SELECT). This is a common technique used by ransomware to inhibit system recovery by deleting volume shadow copies.
This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.
This rule detects anomalous activity where a 'post_save_repair' event is triggered multiple times for the same WordPress post ID within a short timeframe. Repeated post repair operations could indicate automated exploitation attempts, malformed content injection, or excessive resource usage causing application-layer instability.
Detects the mass creation of potential ransomware note files (e.g., decrypt.txt, recover.hta) across different directories on a single host. The rule correlates this file creation activity with the execution of common viewers (notepad.exe, mshta.exe, wordpad.exe) using the note file in the command line, while specifically excluding scenarios where standard file encryption activity is concurrent.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the creation of a specific wallpaper file ('image_danger.jpg') associated with the GigaWiper malware family, which is indicative of a system defacement attempt during the destructive phase of an attack.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Page 41 of 149