Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects attempts to inhibit system recovery by stopping the Volume Shadow Copy Service (VSS) using utilities like net, net1, or sc, or deleting shadow copies using vssadmin.exe, excluding known backup agents.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects shadow copy destruction and recovery feature tampering used
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects usage of vssadmin or wmic to delete Volume Shadow Copies
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
The following analytic detects the deletion of shadow copies using the vssadmin.exe or wmic.exe utilities. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because deleting shadow copies is a common tactic used by attackers to prevent recovery and hide their tracks. If confirmed malicious, this action could hinder incident response efforts and allow attackers to maintain persistence and cover their activities, making it crucial for security teams to investigate promptly.
The following analytic detects the use of PowerShell to delete shadow copies via the WMIC PowerShell module. It leverages EventCode 4104 and searches for specific keywords like "ShadowCopy," "Delete," or "Remove" within the ScriptBlockText. This activity is significant because deleting shadow copies is a common tactic used by ransomware, such as DarkSide, to prevent data recovery. If confirmed malicious, this action could lead to irreversible data loss and hinder recovery efforts, significantly impacting business continuity and data integrity.
The following analytic detects the modification of registry keys to disable System Restore on a machine. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with System Restore settings. This activity is significant because disabling System Restore can hinder recovery efforts and is a tactic often used by Remote Access Trojans (RATs) to maintain persistence on an infected system. If confirmed malicious, this action could prevent system recovery, allowing the attacker to sustain their foothold and potentially cause further damage or data loss.
This analytic detects the use of WMIC to delete volume shadow copies, which is a common technique used by ransomware actors to prevent system recovery. Ransomware like Cactus often delete shadow copies before encrypting files to ensure victims cannot recover their data without paying the ransom. This behavior is particularly concerning as it indicates potential ransomware activity or malicious actors attempting to prevent system recovery.
The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because ransomware often disables recovery options to prevent system restoration, making it crucial for SOC analysts to investigate. If confirmed malicious, this could hinder recovery efforts, allowing ransomware to cause extensive damage and complicate remediation.
The following analytic identifies the resizing of shadow storage volumes, a technique used by ransomware like CLOP to prevent the recreation of shadow volumes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "vssadmin.exe" with parameters related to resizing shadow storage. This activity is significant as it indicates an attempt to hinder recovery efforts by manipulating shadow copies. If confirmed malicious, this could lead to successful ransomware deployment, making data recovery difficult and increasing the potential for data loss.
The following analytic detects the execution of wbadmin.exe with flags that delete backup files, specifically targeting catalog or system state backups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because it is commonly used by ransomware to prevent recovery by deleting system backups. If confirmed malicious, this action could severely hinder recovery efforts, leading to prolonged downtime and potential data loss.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit, and PowerShell) to delete Volume Shadow Copies, backup catalogs, or disable system recovery features. This is a common tactic used by ransomware and destructive actors to prevent system recovery.
Detects the deletion of volume shadow copies using common Windows administrative tools such as vssadmin, wmic, and PowerShell. This activity is frequently observed during the pre-encryption stage of ransomware attacks to prevent system restoration.
Detects the use of native Windows utilities (vssadmin.exe, wmic.exe, wbadmin.exe, bcdedit.exe) to delete volume shadow copies, backup catalogs, or modify boot configuration data to inhibit system recovery, a common behavior observed during ransomware and wiper attacks.
Detects the deletion of Volume Shadow Copies and disabling of Windows boot recovery options using native administrative utilities such as vssadmin, wmic, powershell, wbadmin, and bcdedit. This behavior is frequently associated with pre-encryption activities in ransomware attacks to prevent system restoration.
Detects the use of Windows administrative tools (vssadmin, wbadmin, and bcdedit) to delete Volume Shadow Copies, backup catalogs, and disable system recovery mechanisms. This behavior is highly indicative of preparatory stages for destructive wiper malware attacks, such as those historically observed by the Sandworm (Seashell Blizzard) group (e.g., CaddyWiper, Industroyer2).
Detects high-volume or multi-type destructive operations against cloud backup, snapshot, and recovery infrastructure, including the disabling of immutability policies or soft-delete protections. This activity is consistent with ransomware actors attempting to eliminate recovery options before encrypting data.
This rule detects attempts to steal the Active Directory database (ntds.dit) and associated security files by creating volume shadow copies using native Windows utilities like ntdsutil, vssadmin, or wmic. It also monitors for direct file system access or creation attempts related to these sensitive database files within shadow copy paths.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, powershell, diskshadow) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware operations intended to inhibit system recovery.
Page 1 of 28