Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects a CPU miner configured with an unusually high thread count or affinity mask after GPU capability checks. This behavior is indicative of cryptojacking activity where an attacker is attempting to maximize CPU resource utilization for cryptocurrency mining.
Detects .NET processes creating a high volume of files with random 4-character extensions, excluding common temporary and log files. This behavior is indicative of the Chaos ransomware, which MuddyWater has used as a distraction for espionage.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
Detects email bombing attacks via high-volume inbound email delivery
Detects attempts to overwrite web server content files for defacement
Detects unexpected system shutdown or reboot commands
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Detects bulk file deletion indicating a data destruction attack
Detects mass file renaming indicating ransomware encryption activity
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule looks for the creation of a file named 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' or the execution of 'meshagent' or 'meshcentral' processes from suspicious directories or initiated by common shell/download utilities.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects the execution of a Go binary named 'servertool.exe' or any executable containing 'servertool' in its command line, when combined with suspicious command-line arguments indicative of file deletion or directory traversal, while excluding common system directories like 'Program Files' and 'Windows'. This rule aims to identify activity associated with the Prinz Eugen ransomware.
This rule detects the execution of multiple commands commonly used by adversaries to inhibit system recovery, often seen in ransomware attacks. Specifically, it looks for the use of 'vssadmin delete shadows', 'wbadmin delete catalog', 'bcdedit /set', or 'diskpart' in conjunction with '/quiet' or '/force' parameters, and triggers if two or more such commands are executed within an hour on the same computer by the same user.
This rule detects the execution of multiple commands commonly used by adversaries to inhibit system recovery, often seen in ransomware attacks. Specifically, it looks for the use of 'vssadmin delete shadows', 'wbadmin delete catalog', 'bcdedit /set', or 'diskpart' in conjunction with '/quiet' or '/force' parameters, and triggers if two or more such commands are executed within an hour on the same computer by the same user.
Page 71 of 149