Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects cloud service hijacking for cryptocurrency mining workloads
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
This rule detects the use of standard Windows administrative utilities (vssadmin, wmic, bcdedit) to delete volume shadow copies or modify boot configuration settings to disable recovery features. This behavior is a common indicator of ransomware or destructive malware activity attempting to prevent system restoration after data encryption or destruction.
Detects behavior associated with TrymeLocker ransomware, specifically the removal of critical Windows components like cmd.exe. The rule monitors for the sequence of taking file ownership using takeown.exe, modifying file permissions with icacls.exe to grant full access, and subsequent deletion of the file using del commands. It also identifies Sysmon file deletion events targeting cmd.exe within system directories by non-system processes.
Detects VLC media player crash conditions or suspicious child process creation immediately following the processing of VP9-encoded video files (.webm, .mkv). This behavior is indicative of potential memory corruption exploitation, such as the vlc-vp9-reschange-crash-poc, which aims to leverage malformed resolution change events for application instability or code execution.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects processes running at High or System integrity levels that correlate with the creation of specific file artifacts known to be associated with VILE ransomware. The rule monitors for potential privilege escalation or token manipulation indicative of the ransomware's attempt to gain necessary permissions for encryption operations.
Detects the execution of notepad.exe where the command line arguments reference a file path located in 'C:\temp\' and include a filename typical of ransomware notes, such as 'HowToRestoreFiles.txt'. This behavior is characteristic of ransomware displaying instructions to the victim after file encryption.
Detects high-volume file modification or renaming operations targeted at specific file extensions (dcm, tf, parquet) commonly associated with sensitive data (DICOM imaging, Terraform states, database parquet files) or operations occurring within Docker volume directories. The detection uses an aggregation logic to identify when a process performs more than 20 such file operations on an endpoint, which may indicate bulk data exfiltration, encryption, or tampering.
This rule detects potential ransomware activity by monitoring for the deliberate inhibition of Windows system recovery features (via vssadmin, wmic, or bcdedit) and the subsequent staging of archived data in public user directories.
Detects Reynolds ransomware terminating hardcoded EDR/AV process names via its NSecKrnl kernel driver. The rule identifies process terminations of known security software executables and correlates it with the presence of the '402.sys' driver in the 'C:\ProgramData' folder, which is associated with the NSecKrnl driver used by Reynolds ransomware.
Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.
This rule detects a high frequency of file rename or modification events targeting files with extensions commonly associated with ransomware. It filters out activity from processes signed by trusted vendors like Microsoft, Symantec, Sophos, and Trend Micro to reduce noise, flagging mass rename operations that could indicate an active ransomware encryption process.
Detects the execution of native Windows utilities (vssadmin, wbadmin, bcdedit, diskshadow) configured to delete volume shadow copies, remove backup catalogs, or disable automatic recovery features. This activity is a common indicator of ransomware preparation to prevent data recovery.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
Detects automated payroll fraud attempts by monitoring for scripting engines initiating HTTP connections to known payroll platforms (e.g., Workday, ADP) or spawning child processes with payroll-related command-line arguments. This behavior is indicative of post-AiTM session abuse, where attackers manipulate financial accounts or automate unauthorized payroll changes via malicious scripts.
Detects a burst of commands consistent with Akira ransomware's recovery inhibition phase, where multiple system recovery features are disabled or deleted (e.g., Volume Shadow Copies, Windows Backup Catalog, Boot Recovery) within a 5-minute window on the same endpoint.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects the execution of 'REAGENTC.EXE' with the '/disable' argument and 'WBADMIN.EXE' with 'delete catalog -quiet' within a 10-minute window on the same device. This combination of commands is indicative of an adversary attempting to inhibit system recovery by disabling Windows Recovery Environment and deleting the Windows Backup Catalog, often seen in ransomware attacks.
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
Page 52 of 149