Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects rapid sequential file rename/write operations across multiple directories within a short window, which is a behavioral signature of active ransomware encryption activity. The rule specifically looks for more than 200 file operations (renamed or created) with a file extension matching a 4-8 character alphanumeric pattern, across more than 5 unique folders, all occurring within a 2-minute window and completing within 120 seconds.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects potential memory leak debugging or exploitation attempts related to the Squid proxy server by monitoring process command lines for keywords like 'leak', 'memory', 'valgrind', 'gdb', or 'debug'. This could indicate an adversary attempting to exploit a memory leak vulnerability or a developer debugging one.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by identifying rapid bulk file modifications or renames that result in files adopting extensions commonly associated with ransomware encryption. It looks for a high volume of file events (creation, modification, rename) within a short timeframe (1 hour) where the new file extensions match a predefined list of ransomware-specific extensions.
Detects the widespread creation of the specific !readme_medusa!.txt ransom note or its HTML variant across directories, indicating a Medusa ransomware operation.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
This rule detects the use of native Windows administration tools (vssadmin, wmic, wbadmin, and bcdedit) to inhibit system recovery. Actions include deleting volume shadow copies, deleting the backup catalog, disabling Windows automatic recovery, or tampering with boot status policies. Such activities are commonly associated with ransomware operations intended to prevent system restoration and increase the impact of data destruction.
Detects the suspicious execution of multiple system recovery inhibition commands (vssadmin.exe, bcdedit.exe, and wbadmin.exe) within a short timeframe (60 seconds) on the same host. This pattern of activity is consistent with the pre-encryption stage of many ransomware attacks, where adversaries attempt to prevent system restoration by deleting shadow copies and backup catalogs, and disabling boot recovery.
Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.
Detects the use of icacls.exe and takeown.exe to recursively modify file permissions, specifically targeting broad filesystem paths or system-critical binaries. This behavior is indicative of ransomware preparing for encryption by taking ownership and modifying ACLs to ensure access to protected files.
Detects unauthorized deletion, renaming, or movement of system command-line utilities (cmd.exe) located in System32 or SysWOW64, correlated with the use of standard Windows tools to delete Volume Shadow Copies. This behavior is indicative of ransomware preparation to inhibit system recovery and interfere with standard administration tasks.
Detects the modification of the 'LegalNoticeText' registry value to display Pay2Key ransomware-related strings. This activity is indicative of a system being targeted or compromised by the Pay2Key ransomware, which uses this registry key to display a ransom message upon user logon.
Detects the execution of notepad.exe where the command line arguments reference a file named 'HowToRestoreFiles.txt'. This behavior is characteristic of ransomware variants that launch Notepad to display instructions to victims after file encryption has occurred.
Page 65 of 149