Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
41
34
25
13
13
Contributors
30
26
18
11
11
Categories
62
57
32
28
19
Platforms
39,920
7,245
6,529
3,864
3,627
150
Products / Services
28
14
13
11
11
MITRE Techniques
52
51
42
35
23
CVEs
4
2
1
1
1
IDS Classtypes
8
4
1
IDS Protocols
12
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
Detects the execution of command-line tools associated with virtual machine management (ESXi CLI, PowerCLI, Hyper-V). The rule monitors for specific process executions (esxcli, vim-cmd, powershell) that involve administrative VM actions such as creating or starting virtual machines, which may indicate malicious VM orchestration, data destruction, or persistence attempts in virtualized environments.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Detects the execution of process images known as 'XDRAgent.exe' or VMware administration tools ('vmtools.exe', 'vmwared.exe') when their command lines include patterns commonly associated with reverse shell communication, suspicious IP addresses, or unauthorized administrative arguments.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
LockBit C2Beacon
YARA
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects upload of potentially malicious VIB packages to ESXi hosts
Rust-based ransomware family targeting enterprise environments
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
This rule monitors for administrative VMware operations (cloning, snapshotting, or process manipulation) performed on sensitive infrastructure servers (such as Domain Controllers, PKI, Vault, or ADFS) that occur outside of a designated maintenance window by non-authorized accounts. It leverages tools like vim-cmd, esxcli, or govc to detect potential unauthorized VM manipulation that could lead to data theft, snapshot-based credential extraction, or unauthorized system changes.
Detects anomalous file modification or deletion events targeting the SSH known_hosts file. This activity can be indicative of VECT ransomware, which zeroes out this file across compromised Linux and ESXi systems to suppress host-key warnings, enabling silent lateral movement via SCP and SSH.
Detects unauthorized or suspicious use of virtualization management tools (e.g., esxcli, vim-cmd, PowerShell cmdlets for vSphere/Hyper-V) to perform disruptive actions such as powering off VMs, removing snapshots, or modifying firewall configurations. The rule excludes activity originating from standard management processes and trusted VMware/Microsoft signed processes.
Detects unauthorized or suspicious use of virtualization management tools (e.g., esxcli, vim-cmd, PowerShell cmdlets for vSphere/Hyper-V) to perform disruptive actions such as powering off VMs, removing snapshots, or modifying firewall configurations. The rule excludes activity originating from standard management processes and trusted VMware/Microsoft signed processes.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Page 3 of 8