Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects high-frequency file creation or modification events within directories matching the 'RP_<UUID>' naming pattern in Windows temporary folders. This behavior is indicative of Poseidon generator/worker threads attempting to cause I/O saturation to exploit Time-of-Check Time-of-Use (TOCTOU) vulnerabilities in security products like Microsoft Defender (MsMpEng.exe).
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
This rule detects potential ransomware activity by monitoring for QEMU virtualization software spawning child processes followed by mass file encryption (using extensions .threeamtime or .bqtlock) and the creation of typical ransomware note files (e.g., RECOVER.txt, README.txt).
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
Detects BQTLock ransomware activity by monitoring for mass file encryption events (file extensions .bqtlock or .baqiyatlock) and the creation of associated ransom note files (README.bqtlock or HOW_TO_DECRYPT.txt) using Sysmon and Windows Security Event logs.
Detects evidence of final-stage PayoutsKing or 3AM ransomware deployment by identifying the execution of shadow copy or backup catalog deletion commands on a host where the QEMU virtualization process is simultaneously active, indicative of ransomware activity following lateral movement via VM-based techniques.
Detects LCRYX ransomware activity orchestrated by VBScript using wscript.exe or cscript.exe. The rule monitors for the mass encryption of files identified by the .lcryx extension and the creation of PLEASEREADME.txt ransom notes, typical behaviors of this ransomware variant.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
This rule detects a single process creating a large number of files with diverse file types within a short time frame (5 minutes). This behavior can be indicative of malicious activity such as ransomware encrypting files, data staging for exfiltration, or malware dropping multiple components.
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects the transmission of plaintext 'OfflineFrame' protocol messages (such as CONNECTIONRESPONSE, BANDWIDTHUPGRADE, or KEEPALIVE) within the 'Nearby Connections' protocol that lack required encryption ('SecureMessage') after the UKEY2 key exchange phase. This behavior indicates a potential misconfiguration or an attempt to intercept/manipulate Nearby Connections traffic.
Detects the transmission of plaintext 'OfflineFrame' protocol messages (such as CONNECTIONRESPONSE, BANDWIDTHUPGRADE, or KEEPALIVE) within the 'Nearby Connections' protocol that lack required encryption ('SecureMessage') after the UKEY2 key exchange phase. This behavior indicates a potential misconfiguration or an attempt to intercept/manipulate Nearby Connections traffic.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete Volume Shadow Copies. This activity is a common indicator of ransomware or other destructive attacks aiming to inhibit system recovery.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects anomalous SMB traffic indicating potential ransomware activity. The rule monitors for file operations associated with known ransomware naming conventions (e.g., README.txt, DECRYPT_INSTRUCTIONS) or common ransomware-related extensions. It uses a threshold to identify high-frequency occurrences within a short timeframe, suggesting bulk file renaming or ransom note creation typical of encryption phases.
Page 54 of 149