Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
260 detections
Filters
Last updated
All Time
Detection languages
111
37
36
21
15
Contributors
72
35
28
28
14
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
223
37
4
2
1
Products / Services
84
73
67
48
34
MITRE Techniques
117
98
85
84
77
CVEs
4
2
1
1
1
IDS Classtypes
6
1
IDS Protocols
7
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
Yara rule that detects Cactus ransomware.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the Blitzkrieg ransomware by identifying specific byte patterns associated with its core functionalities: file encryption, searching for files to encrypt, and disabling services. The rule looks for distinct sequences of bytes that indicate these malicious behaviors within a Windows executable file.
Yara rule that detects Blitzkrieg ransomware.
Yara rule that detects GlobeImposter ransomware.
Yara rule that detects Zeppelin ransomware.
Page 13 of 13