Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects S3 object encryption using either customer-provided keys (SSE-C) or externally managed KMS keys (BYOK/XKS). These methods are leveraged by S3 ransomware variants to encrypt data with keys that are not controlled by the victim or AWS, making recovery difficult or impossible without paying a ransom.
Detects potential execution of BQTLock ransomware by identifying characteristic command-line strings, credential staging files, and associated UAC bypass techniques.
Detects process masquerading and resource abuse techniques used in the ShadowRay 2.0 campaign. This includes processes renamed to mimic legitimate system components (e.g., kworker, dns-filter) and the execution of known cryptominers from unusual locations.
DOS Sustained ICMP Flood Attempt
Suricata
This rule detects a sustained ICMP flood attempt, which is a type of Denial of Service (DoS) attack. It triggers an alert if more than 100 ICMP packets (type 8, echo request) are observed from an external network to the home network within a 10-second window, tracked per source IP. This indicates an adversary is attempting to overwhelm the target system or network with ICMP traffic.
This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.
Detects attempts to stop critical services like Veeam and MSSQL, a behavior associated with Cephalus ransomware to ensure successful encryption and hinder recovery.
Detects the crash of lsass.exe caused by WLDAP32.dll, which is a strong indicator of exploitation of the LDAPNightmare vulnerability (CVE-2024-49113). This exploit causes a denial of service on unpatched Windows Servers.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Detects the stopping of a Windows service via the "sc.exe" utility
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.
Detect a system being shutdown or put into different boot mode
Modifications to a config that will serve an adversary's impacts or persistence
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
Detects the use of SDelete to erase a file not the free space
This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.
Detects Cephalus ransomware behavior, specifically the deletion of Volume Shadow Copies and tampering with Windows Defender settings, which are common precursor activities to encryption.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
Detects when an Okta policy is modified or deleted, which could indicate an attempt to alter security controls or bypass existing policies. This activity should be monitored closely as it can precede unauthorized access or other malicious actions.
Detects a process exhibiting multiple behaviors associated with Warlock ransomware. This rule correlates the termination of critical services, deletion of volume shadow copies within a short time window.
This rule detects when an API token is revoked within the Okta environment. API tokens are used for authentication and authorization to access Okta APIs. Revoking a token can be a normal administrative action, but it can also indicate an attempt to disable a compromised token or an adversary attempting to disrupt legitimate access.
Page 94 of 149