Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
This rule detects high-frequency file renaming or creation activities within a short timeframe (60 seconds) that involve uncommon file extensions. This behavior is highly characteristic of the encryption phase of ransomware attacks, where malicious processes quickly rename or encrypt files across the system.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
This rule monitors for administrative VMware operations (cloning, snapshotting, or process manipulation) performed on sensitive infrastructure servers (such as Domain Controllers, PKI, Vault, or ADFS) that occur outside of a designated maintenance window by non-authorized accounts. It leverages tools like vim-cmd, esxcli, or govc to detect potential unauthorized VM manipulation that could lead to data theft, snapshot-based credential extraction, or unauthorized system changes.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects the activity of the Prinz Eugen ransomware, specifically tracking the execution of 'servertool.exe' as it creates temporary files with the '.prinzeugen.tmp' extension and subsequently renames them to finalize file encryption.
Detects a sequence of events where an Amazon S3 bucket is deleted, followed within one hour by the creation of an Amazon Data Firehose delivery stream or an update to a destination using the same bucket name. This pattern indicates a potential bucket name hijacking attempt, where an attacker recreates the deleted bucket to intercept or redirect data streams processed by Firehose.
Detects a potential storage container hijacking attack in Azure, where a container is deleted in one subscription and subsequently recreated with the same name in a different subscription within the same tenant. This sequence can be used to redirect data streams or intercept access to containerized resources.
Detects the 'procq' process establishing network connections to common Monero (XMR) mining pool ports. This behavior is indicative of a cryptominer deployment, specifically associated with the Langflow cryptominer campaign related to CVE-2026-33017.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects the creation of files commonly used as ransom notes (e.g., 'readme_locker' or 'readme_locker.txt') within common user directories such as the Desktop. This behavior is a strong indicator of a ransomware attack post-encryption.
Detects the hallmark Nightspire pre-encryption routine: executing vssadmin.exe or wmic.exe to quietly delete Volume Shadow Copies, preventing host restoration.
Detects BQTLock ransomware anti-analysis checks, specifically looking for processes named 'start.exe' or 'BQT.exe' that exhibit characteristics of PyInstaller environments (via environment variables) or log anti-debugging failure messages. This rule helps identify the initial stages of BQTLock execution where it attempts to evade analysis.
Detects attempts by GreenBlood ransomware or similar threats to delete Volume Shadow Copies and Windows Backup catalogs using 'wmic.exe', 'vssadmin.exe', and 'wbadmin.exe' with specific command-line arguments. This activity is typically performed to prevent system recovery and data restoration.
Detects the creation of a file named '__RestoreYourFiles__.txt' within the Microsoft Word STARTUP folder. This file name and location are commonly associated with ransomware activity, specifically the BlackByte ransomware, which drops this file as a ransom note.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Detects the presence of specific file extensions (.p2k, .3396bw_p2k) often associated with ransomware activity, as well as the creation of 'HowToRestoreFiles.txt' which is a common indicator of a ransom note file.
Page 61 of 149