Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
Detects registry modifications aimed at disabling critical Windows utilities (Task Manager, Registry Editor) or degrading the user interface (swapping mouse buttons, hiding desktop icons). These behaviors are indicative of the CrystalX 'Rofl' prankware and disruption module.
Identifies when a firewall is created, modified, or deleted.
Detects when an a role is modified or deleted in Google Workspace.
Detects the termination of critical administrative (sshd) and data transfer utilities (wget, curl). The Masjesu botnet commonly executes this to disrupt rival botnets and lock out administrators.
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects DNS resolution requests for known Masjesu botnet command and control (C2) domains. Masjesu relies on multiple failover domains to fetch its secondary payload and receive DDoS commands.
Detects when an an application is removed from Google Workspace.
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Detects registry value settings that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects when multi-factor authentication (MFA) is disabled.
Detects when an a role privilege is deleted in Google Workspace.
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Shadow Copies deletion using operating systems utilities
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.
Detects the modification of the registry to disable a system restore on the computer
Page 83 of 149