Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
This rule detects potential ransomware activity by monitoring for two key signals: interaction with known canary/trap files designed to detect unauthorized access, and rapid, mass file modification of common user data extensions within a short timeframe. Either behavior is indicative of encryption or automated file destruction processes typical of ransomware attacks.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
This rule detects when processes other than standard web browsers (Firefox, Chrome, Edge, IE) delete sensitive browser files such as 'cookies.sqlite', 'logins.json', 'Login Data', or 'Cookies'. This behavior is indicative of credential wiping or anti-forensics activity by malware, such as the Remcos RAT, attempting to clear evidence of browser activity.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.
Detects anomalous activity where a process or user attempts to stop or disable multiple security-related services (e.g., Windows Defender, Sysmon, EDR agents) within a short window. This behavior is indicative of an adversary attempting to impair defensive monitoring and protection tools during a compromise.
Detects Akira ransomware-related activity by identifying the creation of characteristic ransom notes or files with the .akira extension, combined with signs of security defense impairment (such as disabling Windows Defender via command line).
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.
Detects the execution of a bash script dropper ('isp.sh') associated with Langflow RCE exploitation (CVE-2026-33017). The rule triggers when command-line arguments indicate an attempt to download and execute the 'lambsys.elf' Go-based cryptominer from a known malicious IP address (83.142.209.214).
Detects cloud service hijacking for cryptocurrency mining workloads
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
Page 51 of 149