Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
684 detections
Filters
Last updated
All Time
Detection languages
430
131
28
27
26
Contributors
418
94
69
25
21
Categories
20,439
11,829
5,873
5,151
4,864
684
Platforms
653
44
16
10
5
Products / Services
105
89
33
22
13
MITRE Techniques
580
574
171
157
131
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of common Windows utilities (diskpart, format, cipher, sdelete, eraser) when used with flags indicative of data destruction or disk wiping behavior. This rule monitors for process creations involving commands designed to irrecoverably erase data or wipe drive contents.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects the modification of an Azure Storage account's encryption settings to use a Key Vault for Customer-Managed Keys (CMK). This activity can be indicative of ransomware attacks where adversaries switch to an attacker-controlled key and then delete it, rendering all data in the storage account inaccessible.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
This rule detects suspicious file renaming activities indicative of ransomware. It specifically looks for files that previously had common document extensions (.doc, .xls, .ppt) being renamed to extensions commonly associated with encryption by ransomware (.encrypted, .locked, .crypted, .ecc). The rule triggers if 20 or more such renames occur within a 5-minute window on a single device.
This rule detects high-frequency file renaming or creation activities within a short timeframe (60 seconds) that involve uncommon file extensions. This behavior is highly characteristic of the encryption phase of ransomware attacks, where malicious processes quickly rename or encrypt files across the system.
This rule detects high-frequency file renaming or creation activities within a short timeframe (60 seconds) that involve uncommon file extensions. This behavior is highly characteristic of the encryption phase of ransomware attacks, where malicious processes quickly rename or encrypt files across the system.
This rule detects potential Akira ransomware activity by correlating three distinct malicious phases on a network: first, the deletion of volume shadow copies using vssadmin, wmic, or powershell; second, the disabling of system recovery features via bcdedit or wbadmin; and third, high-volume file renaming (indicating encryption) across multiple endpoints. The rule aggregates these events to identify coordinated campaign activity across at least two hosts.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.
Detects Payouts King ransomware activity by identifying file rename events to the .ZWIAAW extension or the creation of the 'readme_locker.txt' ransom note on any disk path. The rule specifically accounts for file operations that might utilize techniques like SetFileInformationByHandle for evasion.
Detects potential execution of a Tox ransomware negotiation channel by monitoring for processes that exhibit a high rate of file writes (potential encryption activity) in conjunction with command-line arguments containing specific patterns such as a 76-character string or the 'tox://' URI scheme, which are associated with Tox ransomware client activity.
Detects high-frequency S3 PutObject requests that utilize Customer-Provided Encryption Keys (SSE-C). A high count of such operations within a short window can be indicative of ransomware activity, where an adversary encrypts data within the victim's cloud storage using their own keys to prevent access by the owner.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
This rule detects potential ransomware activity by monitoring for a high volume of file creation or renaming events where the new file names end with common ransomware extensions such as '.encrypted', '.locked', or '.crypted'. It aggregates these events over 5-minute intervals and triggers if 50 or more such files are observed on a single device.
This rule detects suspicious file activity indicative of ransomware by monitoring for a high volume of file creations or renames where the filenames contain common ransomware-related extensions such as '.encrypted', '.locked', or '.ransom'. It aggregates these events over a one-hour period per device and triggers if 20 or more such events occur.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects ransomware activity by identifying two primary indicators: a high volume of file renames to common ransomware extensions within a 5-minute window, and the creation of known ransom notes across multiple directories. It excludes processes signed by trusted vendors to minimize noise.
This rule detects potential ransomware activity by monitoring for two key signals: interaction with known canary/trap files designed to detect unauthorized access, and rapid, mass file modification of common user data extensions within a short timeframe. Either behavior is indicative of encryption or automated file destruction processes typical of ransomware attacks.
Page 6 of 33