Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,124 detections
Filters
Last updated
All Time
Detection languages
1,063
796
474
242
137
Contributors
463
427
399
318
291
Categories
927
772
637
574
311
Platforms
2,113
365
219
214
142
Products / Services
488
482
389
167
150
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
3,124
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations.
Detects when the Time Machine backup utility is disabled on macOS using the `tmutil` command-line tool. This action can be performed by an attacker to prevent system backups, hindering recovery efforts after an attack.
This rule detects attempts to delete macOS Time Machine backups using the native utility "tmutil" with the 'delete' command. Adversaries may perform this action to prevent victims from restoring their files, often as a precursor to a ransomware attack or other data destruction activities.
Detects the addition of a new file or path exclusion to macOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up, hindering recovery efforts.
This rule detects the use of 'wbadmin.exe' to recover files from backups. Adversaries may use this technique to restore sensitive files, such as NTDS.DIT (Active Directory database) or Registry Hives, from backups. These files can then be analyzed offline to extract credentials or other sensitive information, potentially leading to further compromise.
Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil".
An attacker can use this to prevent backups from occurring.
An attacker can use this to prevent backups from occurring.
Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil".
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
Detects the recovery of files from backups via "wbadmin.exe".
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
This rule detects when a GitHub enterprise is deleted. This action can lead to significant data loss and disruption of services, indicating a critical security event or a malicious act. The rule correlates the user ID and the GitHub enterprise name over a 30-minute window to identify such deletions.
Detects when a GitHub repository is archived or deleted. This activity could indicate malicious intent, such as an attacker attempting to destroy evidence or disrupt development, or it could be a legitimate administrative action. Monitoring these events is crucial for maintaining code integrity and operational continuity.
Detects when a GitHub organization is removed from an enterprise. This action can lead to a loss of access to repositories, projects, and other organizational resources, potentially disrupting operations or indicating malicious activity aimed at disrupting the software development lifecycle.
This rule detects when a user is blocked from accessing repositories within a GitHub organization. This event is captured from GitHub's audit logs and specifically looks for the 'org.block_user' event type. The rule identifies both the actor who performed the blocking action and the target user who was blocked.
Detects the deletion of files commonly used for backups by adversaries to prevent system recovery. This rule specifically looks for deletion actions performed by common Windows command-line interpreters and system utilities on files with backup-related extensions.
This YARA rule detects the Elpaco ransomware by identifying specific byte patterns within the executable. The patterns are associated with functions for finding files, writing console logs, getting system information, setting up an 'everything' library (likely for file enumeration), and deleting shadow copies. The rule requires all these sets of patterns to be present, indicating a high confidence detection of the Elpaco ransomware.
Detects when a GitHub enterprise is deleted.
Detects when a GitHub organization is removed from an enterprise.
Detects when a GitHub repository is archived or deleted.
This rule detects when an application is deleted in Entra ID (formerly Azure AD). This action is a soft delete, meaning the application can still be recovered. Detection is based on specific event types and product names within Azure AD audit logs.
Yara rule that detects Elpaco ransomware.
Backup Files Deleted
Sigma
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Page 120 of 149