Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects activities aimed at inhibiting system recovery by identifying attempts to delete volume shadow copies via vssadmin, wmic, or powershell, in combination with disabling windows recovery mode using bcdedit. This behavior is indicative of ransomware preparation, where an adversary attempts to prevent the restoration of data before encryption.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.
This rule detects the use of password derivation functions (like argon2id, scrypt, pbkdf2) in command lines, which can be indicative of ransomware activity, specifically associated with Prinz Eugen. It focuses on processes like 'servertool.exe', 'encrypt.exe', and 'powershell.exe' initiating these commands.
This rule detects a suspicious sequence of events indicative of ransomware activity, specifically the Prinz Eugen ransomware. It looks for the execution of common file compression utilities (7z.exe, rar.exe, WinRAR.exe, winzip.exe) followed by the execution of known ransomware encryption executables (servertool.exe, encrypt.exe) on the same device within a 30-minute window. This pattern suggests that an attacker is compressing files before encrypting them, a common tactic to reduce the size of data for faster encryption or exfiltration.
Detects GreenBlood ransomware activity targeting network shares and USB drives. This rule identifies file rename or creation events with specific ransomware extensions (.tgbg, .bak) or ransom note filenames ('READ_ME_TO_RECOVER_FILES.txt'), combined with the use of extended path prefixes (\?\ or \?\UNC\) often employed by ransomware for network/UNC path targeting. The rule aggregates these events and alerts if three or more such files are detected from a single process on a device.
Detects suspicious command-line activity involving 'cmd.exe' executing a batch file named 'cleanup_greenblood.bat' or other batch files from temporary directories with specific cleanup-related commands. This pattern is often associated with malware or post-exploitation cleanup activities.
Detects SSL/TLS handshake flood for service exhaustion attacks
Detects deletion of VSS copies preventing ransomware recovery
Detects high-volume database record modifications
Detects the execution of built-in Windows utilities such as ntdsutil.exe, vssadmin.exe, and diskshadow.exe, often used by attackers to dump the Active Directory database (NTDS.dit) or manipulate volume shadow copies for credential theft or data staging/destruction purposes.
Detects concurrent suspicious network beaconing to Telegram API or IPInfo and high-volume destructive file operations (deletion or modification) on a specific host, indicative of TrymeLocker ransomware activity.
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects the use of legitimate Windows tools (wbadmin.exe and bcdedit.exe) to inhibit system recovery by deleting backup catalogs or disabling automatic Windows recovery features. This behavior is commonly associated with ransomware strains like Pay2Key to ensure that backups cannot be used to restore encrypted data.
Detects the execution of notepad.exe to open a file named 'HowToRestoreFiles.txt' from a temporary directory, which is a common indicator of a ransomware note being displayed to the victim.
Detects the modification of the Windows Registry 'LegalNoticeText' key, which is used to display a message to the user upon logon. This specific rule flags the inclusion of known ransomware-related URLs or domains in the text, commonly used as a ransom note mechanism by adversaries.
Detects the execution of PowerShell commands intended to suspend BitLocker protection on system volumes. This behavior is indicative of VILE ransomware attempting to disable volume encryption to facilitate further malicious activity or file encryption.
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
This rule detects various techniques used by the Lambsys malware for persistence, watchdog monitoring, and cryptocurrency mining on Linux systems. It monitors for crontab modifications, the execution of hidden watchdog scripts in /var/tmp, the usage of pgrep to monitor the miner, and the detachment of processes via nohup.
Detects a sequence of suspicious activities characteristic of an SSH-based worm. The rule correlates non-standard processes reading SSH private keys, the presence of known cryptominer components (lambsys, procq, isp.sh), and subsequent SSH network fan-out activity from the same host, indicating lateral movement.
Page 58 of 149