Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
The following analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR). It leverages Sysmon EventCode 9 to identify processes attempting to read or write to the MBR sector, excluding legitimate system processes. This activity is significant because adversaries often target the MBR to wipe, encrypt, or overwrite it as part of their impact payload. If confirmed malicious, this could lead to system instability, data loss, or a complete system compromise, severely impacting the organization's operations.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
Detects a high volume of specific RPC calls from a single source to a single target, indicative of the TorpeDoS technique. This technique is used to cause a denial of service by overwhelming the target with memory-intensive RPC operations.
Detects attempts to modify Programmable Logic Controller (PLC) ladder logic or firmware. Such modifications can indicate a high-impact attack aimed at disrupting physical processes, damaging equipment, or establishing persistence within the Operational Technology (OT) network.
Detects attempts to disable windows recovery environment using Reagentc.
ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).
It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.
ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).
It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.
Yara rule that detects PathWiper trojan.
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
Detects AK47/X2ANYLOCK ransomware, a tool used by the CL-CRI-1040 threat actor. The rule identifies the malware based on unique PDB paths and embedded ransom note artifacts.
Detects AsyncRAT variants and their forks (DcRat, VenomRAT, etc.) based on process behavior, known IOCs, and security tool evasion techniques.
This rule detects suspicious PowerShell command patterns associated with the Chaos ransomware group. These commands are used for environment setup, preparing for large file downloads, and remote command execution.
The analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. This activity is a technique used by ransomware to prevent forensic recovery of deleted files, hindering incident response efforts by making it impossible to recover critical data.
The following analytic detects the execution of the sdelete.exe application, a Sysinternals tool often used by adversaries to securely delete files and remove forensic evidence from a targeted host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as sdelete.exe is not commonly used in regular operations and its presence may indicate an attempt to cover malicious activities. If confirmed malicious, this could lead to the loss of critical forensic data, hindering incident response and investigation efforts.
Detects the disabling of the 'execInstalledOnly' kernel setting on an ESXi host, a critical security control that prevents the execution of unsigned binaries. This is often followed by a host reboot to apply the change. This TTP is used by threat groups like UNC3944 to prepare the hypervisor for custom ransomware execution.
Detects when a virtual disk (.vmdk) from one virtual machine is attached to a different virtual machine. This is a key TTP used by threat groups like UNC3944 to perform offline credential theft (e.g., copying NTDS.dit from a domain controller) by mounting the disk to a separate, attacker-controlled staging VM.
Detects unauthorized modifications to the Palo Alto Networks firewall configuration, potentially indicating malicious activity or security policy violations. These changes can be leveraged to evade detection, facilitate data exfiltration, or disrupt network defenses, ultimately compromising the integrity and security of the environment.
Detects the Chaos ransomware encryptor based on unique command-line arguments and embedded strings.
Detects modifications to Group Policy Objects (GPOs) that enable script processing. Threat actors, such as Storm-2603, abuse GPOs to deploy ransomware (like Warlock) by adding malicious startup or logon scripts. This detection identifies when the "Group Policy Scripts" client-side extension is added to a GPO, which is a key step in this attack chain. This activity is logged under Event ID 5136 on Domain Controllers.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
The following EQL query can be used to hunt for XMRIG executions within your environment.
The following analytic identifies instances where a Duo administrator creates or updates a policy to explicitly deny user access within the Duo environment. It detects this behavior by searching Duo administrator activity logs for policy creation or update actions where the authentication status is set to "Deny access." By correlating these events with user and admin details, the analytic highlights potential misuse or malicious changes to access policies. This behavior is critical for a SOC to monitor, as unauthorized or suspicious denial of access policies can indicate insider threats, account compromise, or attempts to disrupt legitimate user access. The impact of such an attack may include denial of service to critical accounts, disruption of business operations, or the masking of further malicious activity by preventing targeted users from accessing resources. Early detection enables rapid investigation and remediation to maintain organizational security and availability.
Page 99 of 149