Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the use of native Windows utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe, and diskshadow.exe) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to inhibit system recovery, a common behavior observed in ransomware attacks.
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects the execution of cmd.exe triggered by specific potentially malicious filenames or involving known ransomware-related artifacts, such as 'boottel.dat', ransomware note files, or specific suspicious file extensions like '.SZO'. This is indicative of ransomware deployment or post-compromise cleanup and extortion activities.
Correlates the final execution of a dropped ransomware binary directly from the C:\ProgramData\JWrapper or related SimpleHelp cache directories, identified by common ransomware flags in the process command line.
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
Detects NTP reflection amplification DDoS attack traffic
Detects the high-velocity renaming of files across user directories to append the .gentlemen extension, indicative of ransomware activity.
Detects connections to cryptocurrency mining pools
Detects QoS policy creation with a throttle rate applied, targeting EDR disconnection via extreme low bandwidth. This rule specifically looks for PowerShell commands that include 'ThrottleRateActionBitsPerSecond' in their additional fields, indicating an attempt to set a very low bandwidth throttle.
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
This rule detects a suspicious sequence of events indicative of ransomware activity, specifically the Prinz Eugen ransomware. It looks for the execution of common file compression utilities (7z.exe, rar.exe, WinRAR.exe, winzip.exe) followed by the execution of known ransomware encryption executables (servertool.exe, encrypt.exe) on the same device within a 30-minute window. This pattern suggests that an attacker is compressing files before encrypting them, a common tactic to reduce the size of data for faster encryption or exfiltration.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Page 69 of 149