Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects a sequence of actions often performed by the LCRYX ransomware, characterized by the suppression of Windows boot recovery settings via BCDEdit followed by the deletion of volume shadow copies (using vssadmin or wmic) or backup catalogs (using wbadmin), all executed from the same process within a 10-minute window.
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
Detects the use of built-in Windows utilities (vssadmin, wmic, wbadmin) to delete shadow copies or backup catalogs. This activity is commonly associated with ransomware and data destruction attacks aiming to inhibit system recovery.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects the creation or modification of '.config' or '.exe.config' files within commonly user-writable directories such as AppData, Temp, Downloads, or Desktop. These files are often used by .NET applications to define behavior, and attackers may manipulate them to perform activities such as assembly redirection, loading malicious DLLs, or altering security settings for elevated processes.
Detects the deletion of directory service objects such as users, groups, organizational units, computers, or trusted domains. This is identified via Windows Security Event ID 5141, which tracks when a directory object is deleted.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects HTTP flood application layer DDoS attacks
Detects disabling of Linux audit daemon to remove security monitoring
Detects use of dd command to wipe disk content for data destruction
This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Detects the execution of PowerShell commands that bypass execution policies to specifically disable or suspend BitLocker protection. This behavior is often associated with ransomware or malicious actors attempting to circumvent full-disk encryption to facilitate data manipulation or destruction.
Detects anomalous file modifications to web-accessible directories (such as index.html, dist, public, or wwwroot) by common JavaScript execution environments including node.exe, bun.exe, or npm. This activity is consistent with post-compromise tampering of web assets as observed in the Miasma/Hades campaign, likely involving the abuse of stolen repository credentials to deploy malicious content.
Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.
IoT botnet malware family used for DDoS and proxy infrastructure
Detects suspicious file deletion activities using 'del' command with '/f' flag or 'Remove-Item' PowerShell cmdlet, and log clearing activities using 'wevtutil cl' or 'Clear-EventLog' PowerShell cmdlet. It also identifies Windows Event Log clearing events (Event ID 1102). The rule also includes a specific check for known malicious artifacts in the command line.
Ransomware group exploiting edge devices and managed file transfer software
This rule detects the coordinated execution of multiple Windows command-line utilities (vssadmin, wbadmin, and bcdedit) within a short time frame (60 seconds). These tools are frequently used by ransomware and other malware to delete volume shadow copies, clear backup catalogs, and disable system recovery features, effectively preventing the restoration of the system after a damaging event.
Page 53 of 149