Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects anomalous SMB traffic indicating potential ransomware activity. The rule monitors for file operations associated with known ransomware naming conventions (e.g., README.txt, DECRYPT_INSTRUCTIONS) or common ransomware-related extensions. It uses a threshold to identify high-frequency occurrences within a short timeframe, suggesting bulk file renaming or ransom note creation typical of encryption phases.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
This rule detects ransomware activity by identifying two primary indicators: a high volume of file renames to common ransomware extensions within a 5-minute window, and the creation of known ransom notes across multiple directories. It excludes processes signed by trusted vendors to minimize noise.
Detects multiple execution attempts of common Windows built-in utilities (bcdedit, vssadmin, wbadmin, wmic) used to disable recovery features or delete volume shadow copies within a 5-minute window. This behavior is highly characteristic of ransomware or destructive malware aiming to prevent system recovery.
Detects execution of Windows utilities used by the TrymeLocker ransomware to inhibit system recovery, including disabling boot recovery features via bcdedit, clearing backup catalogs via wbadmin, deleting volume shadow copies via vssadmin or wmic, and disabling the Windows Recovery Environment via reagentc.
Detects multiple concurrent attempts to inhibit Windows system recovery, a common behavior observed in the TrymeLocker ransomware family. The rule triggers when at least two distinct malicious activities occur on the same host within a 120-second window, including the disabling of the Windows Recovery Environment (WinRE) via bcdedit, deletion of shadow copies via vssadmin or wmic, disabling of the Windows backup service (wbengine) via sc, or disabling of System Restore via registry modification.
This rule detects the use of native Windows utilities to inhibit system recovery capabilities. It monitors for the execution of 'wbadmin.exe' to delete the backup catalog and 'bcdedit.exe' to disable automatic boot recovery or ignore boot failures, which are common tactics used by ransomware and other malware to prevent system restoration after data destruction.
Detects the use of the 'fsutil.exe' utility with the 'setZeroData' argument to perform zero-byte file filling, often used to make files unrecoverable. The rule further filters for command lines containing common file deletion commands like 'del' or network connectivity tests like 'ping', indicating possible malicious file removal or destruction activity.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects attempts to delete volume shadow copies using 'vssadmin' or 'wmic shadowcopy' commands. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially during ransomware attacks or data destruction efforts.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects an unusual number of successful encryption-related operations performed by a single caller within a one-hour window in Azure Activity logs. This could indicate legitimate bulk administrative tasks or potentially malicious activity such as data encryption for impact (e.g., ransomware) or preparation for exfiltration by an attacker.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects a sequence of events where a cloud storage bucket is deleted and then immediately recreated with the same name. This pattern is indicative of a potential bucket hijacking attack, where an adversary attempts to take ownership of a bucket to intercept data streams, such as logging sinks, application data, or replication traffic.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
Page 55 of 149