Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the creation of an encryption scope within an Azure Storage account. Attackers may use this to encrypt victim blobs with their own keys, as observed with threat actors like STORM-0501, to demand ransom.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
This rule detects the use of native Windows utilities to inhibit system recovery (e.g., deleting shadow copies or boot configuration changes) and to clear system event logs. These behaviors are common precursors or indicators of post-exploitation activity, such as ransomware deployment or intrusion cleanup.
Detects deletion of VSS copies used by ransomware to prevent recovery
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
This rule correlates suspicious process initiation originating from common web browsers or document handlers (e.g., encoded PowerShell, obfuscated CMD) with subsequent high-impact activities such as QEMU emulator launch, local account creation, DLL side-loading, volume shadow copy deletion, or creation of ransom-related files. This detection follows a multi-stage logic to identify potentially advanced threats or ransomware precursors within a 4-hour window.
Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.
Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.
Detects the creation of specific file artifacts associated with the VILE ransomware. The VILE ransomware Go-based binary is known for employing ETW tracing suppression and direct NT system calls to bypass EDR user-mode hooking. Identifying these unique filenames on the host acts as a high-fidelity indicator that the VILE binary is actively present and executing.
Detects the use of built-in Windows utilities 'wbadmin.exe' and 'bcdedit.exe' with arguments that inhibit system recovery features. Specifically, it monitors for the deletion of the Windows Backup Catalog using 'wbadmin.exe' and the disabling of system recovery/boot failure handling via 'bcdedit.exe'. These actions are commonly performed by ransomware or adversaries to prevent system recovery.
Detects the use of the Windows 'fsutil' utility with the 'setZeroData' argument to zero out file content. This technique is often used by adversaries to perform data destruction or prevent file recovery.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
This rule detects extortion emails that claim corporate data theft and threaten public release unless a cryptocurrency payment is made. It looks for a combination of breach-related subject lines, extortion-specific language in the email body, and indicators such as specific cryptocurrency mentions, urgent deadlines, usage of anonymous email providers, or references to attached proof of compromise.
Detects the use of legitimate Windows administrative tools and scripts to disable or delete system recovery features, such as Volume Shadow Copies, backup catalogs, or boot recovery options. This behavior is a common indicator of ransomware or destructive malware attempting to prevent system restoration.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects Payouts King ransomware activity by identifying file rename events to the .ZWIAAW extension or the creation of the 'readme_locker.txt' ransom note on any disk path. The rule specifically accounts for file operations that might utilize techniques like SetFileInformationByHandle for evasion.
Detects potential execution of a Tox ransomware negotiation channel by monitoring for processes that exhibit a high rate of file writes (potential encryption activity) in conjunction with command-line arguments containing specific patterns such as a 76-character string or the 'tox://' URI scheme, which are associated with Tox ransomware client activity.
Detects Microsoft 365 OAuth access tokens issued via device_code grant — the mechanism abused by the EvilTokens phishing kit — followed within 1 hour by mailbox forwarding rule creation for the same account, indicating persistent BEC access post-compromise.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
Page 49 of 149