Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to initiate an immediate system shutdown (timer set to 0 seconds). The rule monitors for this command being invoked by common execution engines such as cmd.exe or node.exe, which is often associated with disruptive activity or ransomware attempts.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files (e.g., ChromaDB, FAISS SQLite) by non-standard processes, indicating an attacker attempting to poison the AI's retrieval context directly. The rule specifically looks for file modifications or renames of common vector database files (chroma.sqlite3, faiss_index.index, index.faiss) where the initiating process is not a standard AI/ML runtime (python.exe, node.exe, docker.exe) and there is an outbound network connection from that process to a non-localhost IP.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
This rule detects the use of password derivation functions (like argon2id, scrypt, pbkdf2) in command lines, which can be indicative of ransomware activity, specifically associated with Prinz Eugen. It focuses on processes like 'servertool.exe', 'encrypt.exe', and 'powershell.exe' initiating these commands.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule identifies the MeshCentral agent by process image name and common deployment paths or by its execution via common shell/download utilities. It also looks for the creation of the ransom note file 'README-IF-YOU-SEE-THIS-YOU-VE-BEEN-HACKED.TXT'.
Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.
Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.
Detects ScreenConnect or another remote support process directly spawning a mining executable or script. This rule identifies suspicious process creation where a known remote management tool (ScreenConnect, ConnectWiseControl, ClientService) initiates a process with command-line arguments or filenames indicative of cryptocurrency mining (e.g., xmrig, lolminer, nbminer, stratum, wallet, gpu).
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Page 62 of 149