Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects a high volume of files being renamed to the .mkp extension within a 5-minute window, indicative of rapid Makop ransomware encryption.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.
Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.
Detects the use of esxcli or vim-cmd commands on VMware ESXi hosts to power off virtual machines, remove software components (VIBs), or enable maintenance mode. These actions are commonly performed by the Akira ransomware group to disrupt operations and facilitate encryption.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
Detects the execution of known ransomware-related executables ('servertool.exe', 'encrypt.exe') when their command line arguments indicate interaction with cloud storage services such as OneDrive, SharePoint, GoogleDrive, Dropbox, or iCloud. This behavior is indicative of ransomware attempting to encrypt or exfiltrate data from cloud environments.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects unauthorized file writes to specific Google Chrome extension directories associated with the VILE ransomware. The rule monitors for file creation or modification events targeting known extension paths or files with the .vile extension suffix, indicating potential persistence or malicious extension installation.
Detects the use of legitimate Windows system utilities (vssadmin, wmic, bcdedit, wbadmin) to disable recovery mechanisms, such as deleting shadow copies or modifying boot configuration. This behavior is commonly associated with ransomware attempting to prevent system restoration.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
This rule detects two indicators associated with ransomware activity: the modification of the 'legalnoticetext' registry value, which is often used to display ransom notes on the Windows login screen, and the execution of Notepad to open a file named 'HowToRestoreFiles.txt', a common indicator of a ransom note left by ransomware operators.
Identifies the ransomware executing taskkill or native APIs to force-quit database and backup processes (SQL, Exchange) to free file locks. This rule specifically looks for 'taskkill.exe' being executed multiple times (more than 3 within a minute) with command-line arguments targeting common database or backup-related process names like 'sql', 'exchange', 'veeam', 'backup', or 'oracle'.
Detects execution of the Prinz Eugen ransomware 'servertool.exe' accompanied by high-volume file modifications targeting files with the '.prinzeugen' extension. This behavior is indicative of the ransomware's file encryption process, specifically its file system traversal and modification-time sorting strategy used to prioritize recently modified files for encryption.
Detects the creation of a specific ransom note file associated with ShinyHunters activity within PeopleSoft web or application server configuration directories.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
This rule detects attempts to create symbolic links, junctions, or reparse points that target Microsoft Defender directories such as quarantine, platform, or scan paths. Adversaries may use these techniques to interfere with security tools, evade detection, or manipulate how Defender processes files.
Page 67 of 149