Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,124 detections
Filters
Last updated
All Time
Detection languages
1,063
796
474
242
137
Contributors
463
427
399
318
291
Categories
927
772
637
574
311
Platforms
2,113
365
219
214
142
Products / Services
488
482
389
167
150
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,124
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
This query correlates Microsoft Defender for Office 365 signals and Microsoft Entra ID identity data to find the relevant endpoint event BrowerLaunchedToOpen in Microsoft Defender ATP.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
This event reflects relevant clicks on the malicious URL in the spear-phishing email recognized by Microsoft Defender for Office 365.
'This query looks for Microsoft Defender AV detections related to Dev-0530 actors.
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.'
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.'
Run from a Zip File
Sigma
Payloads may be compressed, archived, or encrypted in order to avoid detection
Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Detects specific process characteristics of Maze ransomware word document droppers
Detects command line patterns used by BlackByte ransomware in different operations
Detects LockerGoga ransomware activity via specific command line.
Detects WannaCry ransomware activity
Detects the recovery of files from backups via "wbadmin.exe".
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects the deletion of all backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Page 109 of 149