Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects high-volume file creation events (more than 50 within 5 minutes) on an endpoint using specific file extensions associated with known ransomware families such as INC Ransom (.inc) and Lynx (.lynx).
Detects the use of administrative utilities (takeown, icacls, del) to modify permissions on and subsequently delete critical Windows boot files (winload.exe, winload.efi, ntoskrnl.exe, bootmgr). This activity is associated with GigaWiper and is intended to render the target operating system unbootable.
Detects the use of legitimate Windows tools, bcdedit.exe and reagentc.exe, to disable system recovery mechanisms (boot status policies and the Windows Recovery Environment). This activity is often observed during destructive wiper attacks to prevent system restoration after data destruction.
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
Detects the use of Git commands (filter-branch, rebase -i, or force-push) that rewrite local or remote commit history. These operations are often used by adversaries to hide malicious code injections, remove evidence of unauthorized changes, or manipulate developer repository integrity.
Detects the restart of an Azure Container Instance via the Microsoft.ContainerInstance/containerGroups/restart/action operation. This could indicate an attempt to disrupt service availability or potentially hide malicious modifications made to a container by forcing a state change.
This rule monitors for the creation of files containing the string 'readme_ransom' or the execution of processes that reference 'readme_ransom', specific known ransomware wallet addresses, or associated contact email addresses, which are indicative of post-encryption ransomware activity.
Detects the use of Microsoft lookalike domains for command and control (C2) communication in the context of wiper malware.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
This rule monitors for two indicators of potential ransomware activity: first, a surge in file renaming or creation events across multiple directories within a short window, suggesting large-scale encryption; second, the creation of potential ransom note files across multiple directories or devices. It uses Microsoft Defender for Endpoint data to identify these patterns as part of an incident response strategy.
Detects the creation of BMP files within the Temp directory containing the pattern 'wallpaper_', which is a behavior consistent with LIUSHEN ransomware modifying the desktop background to display a ransom note.
Detects processes that execute commands involving SQL database operations, specifically those related to AES encryption functions or table management (create/drop operations) on configurations. This activity is often associated with potential database manipulation or data destruction attempts by an attacker.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
Detects command-line execution of database drop operations combined with the disabling of foreign key constraints, which is indicative of malicious database manipulation or automated data destruction attempts.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
Detects high-volume file modification events resulting in files renamed with the .inc extension, which is a characteristic behavior of the INC ransomware strain. The rule monitors for more than 50 such modifications on a single host within a 10-minute window, serving as an indicator of active encryption and potential ransomware impact.
Detects attempts by processes to gain raw read/write access to the physical disk (PhysicalDrive0), which is a common technique used by wiper malware to overwrite the Master Boot Record (MBR) and render the system unbootable.
Detects the creation of specific file artifacts associated with VILE ransomware in the Windows local temporary directory, indicating potential post-infection activity such as ransom note preparation or file staging.
Page 44 of 149