Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the modification of Windows Registry keys used to disable System Restore functionality, which can be an indication of an adversary attempting to inhibit system recovery.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
Detects a Windows system BugCheck (Blue Screen of Death) event that occurs within two minutes of a process termination event. This behavior can be indicative of a process intentionally causing a system crash, often utilized by malware that abuses critical-process protection or attempts to evade analysis by forcing a system halt.
Detects high-frequency file write activity combined with the creation of text files, which is a common behavior exhibited by ransomware during the encryption phase of an attack. The rule monitors for a large volume of file creations across a host and specific patterns indicative of ransom note generation.
Detects the mass termination of processes related to productivity suites (Office, Thunderbird), database management (SQL, Oracle, MySQL, Postgres), system backups (VSS), and security monitoring/analysis tools (Task Manager, Wireshark, Process Explorer/Monitor). This activity is highly suspicious and may indicate an attacker attempting to disrupt services, hinder analysis, or prepare a host for destructive activities like data encryption or deletion.
Detects the creation of 'delete.me' files in critical Windows directories (specifically C:\Windows and SYSVOL paths). This behavior is associated with the Akira ransomware, which uses these marker files to coordinate domain-wide encryption tasks, often executed by the System account during the preparation phase of an attack.
Detects the use of native Windows administration utilities (vssadmin, wbadmin, bcdedit, wmic, powershell) to delete shadow copies, modify boot configurations to disable recovery, or remove backup catalogs, a behavior typically performed by ransomware groups like The Gentlemen to prevent system recovery.
Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.
Detects signs of a supply chain attack, specifically referencing the IronWorm/Shai-Hulud pattern, involving the backdating of git commits, manipulation of git environment variables (GIT_COMMITTER_DATE/GIT_AUTHOR_DATE) to mask malicious activity history, and the use of 'touch' commands to modify file timestamps on project-related binaries and configuration files.
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects opportunistic lock (oplock) placement on wermgr.exe alternative data streams or volume shadow copy paths. This behavior is associated with the RoguePlanet exploit chain, which attempts to pause the Microsoft Defender service (MsMpEng.exe) by creating a Time-of-Check to Time-of-Use (TOCTOU) race condition during the quarantine process.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
Detects the use of native Windows utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, disable system recovery, or remove backup catalogs, which are common actions taken by ransomware to inhibit system recovery.
Detects rapid file renaming of user-critical documents and media files to an .encrypted extension, indicative of mass file encryption activity typically associated with ransomware.
This rule detects potential ransomware or remote access trojan (RAT) activity by identifying either specific command-line indicators (/encrypt, /decrypt) or a high volume of file modifications (create, modify, or rename) across multiple directories within a short time frame, which is characteristic of mass file encryption operations.
Page 45 of 149