Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects indicators of ransomware-related anti-forensic behavior, including the deletion of Volume Shadow Copies via vssadmin or wmic, disabling system recovery via bcdedit, and the clearing of Windows event logs via wevtutil or system event log clearing events.
Detects DNS queries to Gofile infrastructure originating from processes executing from typically transient directories (AppData or Temp). This behavior is characteristic of VILE ransomware, which stages compressed user files in these directories before exfiltrating them via Gofile as part of a double-extortion strategy.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
Detects the execution of native Windows utilities (vssadmin, wmic, bcdedit) used to inhibit system recovery or modify boot configuration, such as deleting shadow copies or disabling recovery features. The rule further flags these actions when executed by suspicious parent processes, processes outside of standard system paths, or via WMI/DCOM interfaces frequently associated with ransomware and lateral movement.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Detects the modification of an Azure Storage account's encryption settings to use a Key Vault for Customer-Managed Keys (CMK). This activity can be indicative of ransomware attacks where adversaries switch to an attacker-controlled key and then delete it, rendering all data in the storage account inaccessible.
Detects the execution and download of the 'isp.sh' shell dropper and the 'lambsys' Go-based cryptominer binary on Linux systems. This rule monitors for common dropper patterns, including shell execution of piped commands, use of curl/wget to fetch known malicious components, and instances where Langflow processes attempt to spawn shell-related child processes for potential payload execution.
Detects host fingerprinting and geolocation activity performed by the Lambsys/procq cryptominer. The rule identifies processes like curl or wget querying external IP intelligence services (ipinfo.io, ip-api.com) when associated with suspicious binary paths or spawned by known miner processes.
This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Page 47 of 149