Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects scenarios where an attacker attempts to delete existing VSS backup.
Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.
Detects scenarios where an attacker attempts to delete or resize existing VSS backup.
Detects scenarios where an attacker attempts to delete existing Windows native backup (only available on Windows Server).
Detects scenarios where an attacker enable or reconfigure BitLocker on multiple hosts for ransomware purposes.
Detects scenarios where an attacker attempts to delete existing Windows native backup by reducing the allocated backup storage.
Detects scenarios where an attacker attempts to stop multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
Detects scenarios where an attacker attempts to delete multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
Delete Shadow Copy Via Powershell
Detects scenarios where an attacker attempts to kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
Detects scenarios where an attacker configures BitLocker for ransomware purposes.
Detects scenarios where an attacker attempts to disable
Detects the s1ngularity malware attempting to add a shutdown command to shell configuration files (`.bashrc`, `.zshrc`) for persistence and system lockout.
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system. Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging. Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
This detection identifies the presence of PromptLock ransomware by looking for known malicious file hashes (SHA1 and SHA256). PromptLock is reported to be the first AI-powered ransomware, written in Go, and uses a local AI model to generate malicious Lua scripts. The rule searches across both file and process creation events for wider coverage.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
Detects the execution of "taskkill.exe" with the /f (force) flag, which is used to forcefully terminate processes. This activity can be leveraged by attackers for data destruction or data encryption for impact, particularly against services like Exchange and SQL Server. The rule includes filters to reduce false positives from common installer behaviors.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that delete shadow copies on systems, which can be a defense evasion technique to prevent system recovery. The rule identifies instances where diskshadow.exe is launched with the script execution flag.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag, where the script is located in a potentially suspicious directory such as temporary folders or user application data directories. This behavior is often associated with defense evasion and system recovery inhibition by adversaries.
Detects attempts to disable the Windows Recovery Environment (WinRE) using the `reagentc.exe` command-line tool with the `/disable` argument. Disabling WinRE can prevent system recovery and troubleshooting, which is a common tactic used by adversaries to hinder incident response and recovery efforts.
Detects the execution of "Diskshadow.exe" in script mode with a potentially uncommon script extension. This rule requires initial baselining of allowed script extensions to minimize false positives. Adversaries may use Diskshadow.exe, a legitimate Windows utility, to proxy execution of malicious scripts, often as a defense evasion technique.
Page 98 of 149