Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects dnsmasq or its DHCP helper child process terminating abnormally on Linux hosts due to signals like SIGSEGV, SIGABRT, SIGBUS, or SIGILL. This behavior is indicative of a crash, potentially caused by exploitation attempts of vulnerabilities such as CVE-2026-4892, a heap buffer overflow in dnsmasq's helper.c when processing oversized DHCPv6 Client Identifier (CLID) options. This rule fires post-impact, complementing network-side detections.
Detects potentially malicious SMB activity associated with GhostLock-style
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
This rule detects potential log tampering activities on Linux systems followed by service manipulation within a 20-minute window on the same host.
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Detects destructive Linux commands such as recursive root directory deletion (rm -rf /*) and random data disk wiping (dd if=/dev/urandom of=/dev/sdX). This behavior has been observed as payloads in indirect prompt injections targeting LLM agents to destroy host filesystems.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects the specific vssadmin command used by VECT ransomware to silently delete all volume shadow copies. Shadow copy deletion is a critical precursor to ransomware impact, effectively removing localized backup recovery options.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Detects the usage of the 'fsutil' command line tool to create a massively sized file explicitly named 'DiskFillerFile' to exhaust available disk space. This technique was observed in the Lotus Wiper destructive campaign to corrupt system operations and complicate recovery efforts.
This rule detects attempts to delete volume shadow copies using 'vssadmin.exe' or 'wmic.exe' with specific command-line arguments. This activity is often associated with ransomware or other destructive malware aiming to inhibit system recovery. The rule explicitly excludes commands containing 'backup' to reduce false positives.
Detects the execution of the Windows 'diskpart' utility combined with the 'clean all' command. This command forcefully overwrites all partition data with zeroes and is utilized by destructive threats, such as Lotus Wiper, to irrevocably destroy logical volumes.
Detects the specific usage of the 'net.exe' or 'net1.exe' command to lock out user accounts by setting them to inactive and restricting login times. This behavior was observed in the Lotus Wiper destructive campaign to prevent remediation before wiping the system.
Detects the use of esxcfg-advcfg to alter the BufferCache settings (MaxCapacity or FlushInterval) on an ESXi host. This activity is often associated with ransomware variants like Gentlemen ransomware, which modify these settings to prepare the storage layer for fast, reliable bulk file encryption.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
This rule detects when a device wipe or delete operation is performed via Microsoft Intune. It specifically looks for 'wipe ManagedDevice' or 'Delete ManagedDevice' operations in Intune audit logs within the last 24 hours. The rule is designed to be correlated with other alerts by filtering on a specific ActorUPN, indicating a potential malicious mass device wipe attack.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
This rule detects when critical services, including security agents, backup solutions, and remote management tools, are stopped on a host. Adversaries often stop these services to evade detection, disable security controls, or inhibit system recovery during attacks like ransomware.
Detects the execution of bcdedit.exe to disable the Windows Recovery Environment or ignore boot failures. This is a common pre-encryption technique used by Kyber ransomware to prevent defenders from restoring the OS.
Detects the use of esxcfg-advcfg to alter the BufferCache settings on an ESXi host. This activity can be a precursor to bulk file encryption, as seen with the 'Gentlemen Linux variant' which modifies VMFS write buffer and flush interval to prepare ESXi hosts for fast, reliable encryption.
Page 82 of 149