Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the use of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin, PowerShell) to disable or delete system recovery features, such as volume shadow copies, backup catalogs, or boot recovery options. These actions are common indicators of malicious activity, particularly ransomware, where an attacker attempts to prevent system recovery before data encryption or destruction.
This rule detects the creation of a specific named mutex associated with the GreenBlood ransomware encryptor. The mutex name typically starts with 'Global\\GREENBLOOD_ENCRYPTOR_MUTEX_'. The presence of this mutex indicates potential GreenBlood ransomware activity on the system.
Detects GreenBlood ransomware activity by monitoring for the creation of its specific ransom note file ('READ_ME_TO_RECOVER_FILES.txt') and the renaming of files to its characteristic encrypted extensions ('.tgbg' or '.bak'). The rule aggregates these events by device and process, triggering an alert if a ransom note is dropped or if more than 5 files are renamed with the ransomware's extensions.
Correlates the deployment of the specific Nightspire ransom note (Nightspire_Readme.txt) across multiple directories during the encryption phase, identifying instances where more than 10 such files are created within a minute by the same process on a device.
Identifies the ransomware executing taskkill or net stop to forcefully terminate SQL, Exchange, and backup services, freeing file locks for successful encryption.
Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Identifies the creation of scheduled tasks for Windows System Health Monitor persistence, specifically looking for 'schtasks.exe' creating tasks with names like 'Windows System Health Monitor' or 'Windows System Health Check', in conjunction with 'RuntimeHost.exe' activity. This pattern is indicative of cryptojacking campaigns abusing ScreenConnect.
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
Detects high-volume file renaming activity where the new file extensions correspond to common ransomware patterns (e.g., .locked, .encrypted, .wncry). The rule excludes processes signed by reputable vendors to reduce noise.
Detects the creation of common ransomware note file names with suspicious extensions.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
Detects the creation of multiple ransom notes (HTML, TXT, or HTA files with specific keywords) across several distinct directories, indicative of MedusaLocker ransomware activity.
Detects potential memory leak debugging or exploitation attempts related to the Squid proxy server by monitoring process command lines for keywords like 'leak', 'memory', 'valgrind', 'gdb', or 'debug'. This could indicate an adversary attempting to exploit a memory leak vulnerability or a developer debugging one.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
Affair-Build Script Restarting VDS
Cortex XDR
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` that includes the command-line arguments related to an 'affair-build.bat' script or directly stopping/starting the Virtual Disk Service (VDS) using `net` or `sc` commands. It aims to identify cleanup or persistence script sequences that manipulate the VDS.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Page 68 of 149