Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.
Detects high-volume file renaming activity where the new file extensions correspond to common ransomware patterns (e.g., .locked, .encrypted, .wncry). The rule excludes processes signed by reputable vendors to reduce noise.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Identifies the ScreenConnect Client Service initiating network traffic to the domain 'directdownload.icu', which has been associated with cryptojacking campaigns. This activity indicates potential compromise and resource hijacking.
Detects modification of scripts in extension folders.
Detects abnormal execution of Virtual Disk Service (vds.exe, vdsldr.exe) or Windows Backup Engine (wbengine.exe) processes. This activity is often abused by Makop ransomware to hinder system recovery by deleting backups or shadow copies. The rule specifically looks for these executables being initiated by processes other than svchost.exe, services.exe, or vds.exe, which are legitimate initiators.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Identifies Nightspire utilizing bcdedit.exe to modify boot configuration data, explicitly ignoring all boot failures and disabling the Windows recovery environment.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
Correlates the SimpleHelp RMM execution with vssadmin.exe commands designed to delete shadow copies prior to ransomware deployment.
Detects manipulation of financial transaction data for financial theft
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects the deletion of volume shadow copies via vssadmin or wmic, removal of the Windows backup catalog using wbadmin, and the disabling of system recovery boot settings via bcdedit. This activity is consistent with pre-encryption preparation behavior observed in Akira ransomware attacks.
Detects coordinated activity characteristic of Akira ransomware, involving the inhibition of system recovery mechanisms (shadow copy deletion, backup catalog deletion, recovery policy modification) followed by high-volume file renaming (indicative of file encryption) across multiple host systems within a short timeframe.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Identifies the Go payload using bcdedit to disable automatic startup recovery and ignore boot failures, which is a common technique used by ransomware to prevent system recovery.
Detects the high-tempo Medusa ransomware encryption phase by identifying a large number of file renaming operations that append the '.medusa' extension within a short timeframe (1 minute). This rule specifically looks for more than 50 such rename events per device per minute.
Detects the creation and subsequent deletion or modification of 'wipefile.tmp' or similarly named temporary wipe artifacts, which are used by the Gentlemen ransomware during its cleanup phase. This rule specifically looks for file events (creation, deletion, modification) related to this filename.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects the use of built-in Windows utilities (vssadmin, wmic, wbadmin) to delete shadow copies or backup catalogs. This activity is commonly associated with ransomware and data destruction attacks aiming to inhibit system recovery.
Page 63 of 149