Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
90
65
32
11
10
Contributors
44
31
29
23
20
Categories
87
85
84
64
29
Platforms
183
28
17
6
5
Products / Services
48
48
38
38
19
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
Detects log file modification followed by service manipulation to cover tracks.
Used /dev/null, therefore it acts as a stronger version of disable
Used /dev/null, therefore it acts as a stronger version of disable
Detects the termination of critical administrative (sshd) and data transfer utilities (wget, curl). The Masjesu botnet commonly executes this to disrupt rival botnets and lock out administrators.
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects mass service termination targeting backup, database, and virtualization services. The Gentlemen stop Veeam, SQL, Oracle, SAP, Acronis, BackupExec, PostgreSQL, Docker, and VMware services before encryption.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
This rule detects activity associated with the DYNOWIPER malware. It identifies the malware through specific SHA256 file hashes, known filenames (dynacom_update.exe, source.exe, schtask.exe, dynacon_update.ps1, exp.ps1), and process names (dynacom_update.exe, source.exe, schtask.exe, powershell.exe). Additionally, it flags network connections to or from a set of known malicious IP addresses (185.200.177.10, 31.172.71.5, 193.200.17.163, 185.82.127.20, 72.62.35.76) which are associated with VPN logins or exfiltration reverse proxies used by DYNOWIPER.
The rule detects the execution of the devcon.exe process with a command-line argument containing the word "disable". This is a strong indicator that an attempt is being made to disable one or more hardware devices on the system, which is highly suspicious outside of legitimate administrative or deployment activities.
This rule detects DYNOWIPER malware. It uses two primary detection methods: 1. Known SHA256 hashes of DYNOWIPER samples as published in a report. 2. A string-based detection logic derived from CERT Polska, as reproduced in the Elastic DYNOWIPER reporting. This logic looks for specific strings related to file paths, error messages, and Windows API calls, combined with a check for the 'SeShutdownPrivilege' string and a file size constraint, within a PE file (identified by the 'MZ' header).
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects attempts to stop critical services like Veeam and MSSQL, a behavior associated with Cephalus ransomware to ensure successful encryption and hinder recovery.
Detects the stopping of a Windows service via the "sc.exe" utility
This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
Detects a process exhibiting multiple behaviors associated with Warlock ransomware. This rule correlates the termination of critical services, deletion of volume shadow copies within a short time window.
This rule detects specific command-line patterns associated with Snatch ransomware activity. Specifically, it looks for commands that immediately reboot the system into safe mode ('shutdown /r /f /t 00') and commands that stop the 'SuperBackupMan' service ('net stop SuperBackupMan'). These actions are characteristic of Snatch ransomware's evasion and impact tactics, where it reboots into safe mode to bypass security software and stops backup-related services to facilitate encryption.
Detects potential Ryuk ransomware activity by looking for specific command-line patterns. This includes attempts to establish persistence via the Run registry key, deletion of backup files, and stopping critical services using 'net stop' commands.
Page 6 of 12