Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects commands executed on Cisco devices that indicate file deletion or disk formatting activities. It specifically looks for keywords like 'erase', 'delete', and 'format' in Cisco AAA logs, which could signify an attempt to remove files from flash file systems or wipe disk structures. This activity can be part of defense evasion or impact tactics by adversaries.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
This rule identifies when an Amazon Elastic Kubernetes Service (EKS) cluster is either created or deleted. Monitoring these events can help detect unauthorized infrastructure changes, potential resource exhaustion, or malicious activity aimed at disrupting services or destroying data within a cloud environment.
Identifies when an Azure Kubernetes Pod is deleted. This activity could indicate an attempt to disrupt services, evade detection, or remove evidence by an attacker. Monitoring these deletions is crucial for maintaining the integrity and availability of Kubernetes deployments.
This rule detects the execution of system commands commonly used to shut down, reboot, or halt a macOS system. Adversaries may use these commands to disrupt system availability or aid in the destruction of systems.
Detects a user log-off activity. This rule can be used to correlate information during forensic investigations by identifying when a user session ends. It specifically looks for Windows Event IDs 4634 (An account was logged off) and 4647 (User initiated logoff).
Detects a command used by the Conti ransomware group to list volume shadow copies and redirect the output to a log file. This activity is often a precursor to deleting shadow copies to prevent system recovery.
This rule identifies when an Azure DNS zone is either modified or deleted. This activity is detected by monitoring Azure Activity Logs for operations starting with 'MICROSOFT.NETWORK/DNSZONES' and ending with '/WRITE' (for modifications) or '/DELETE' (for deletions). Such changes can indicate malicious activity aimed at redirecting traffic or disrupting services.
Identifies when an Azure Firewall Rule Configuration is modified or deleted. This activity can indicate an adversary attempting to bypass network defenses or disrupt services.
Detects when adversaries delete important scheduled tasks related to system restore, Windows Defender, BitLocker, Windows Backup, Windows Update, Update Orchestrator, or Exploit Guard. This activity could indicate an attempt to disrupt system services or processes, potentially as a precursor to data destructive activities or to hinder defensive capabilities.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
Detects suspicious modifications to BitLocker-related registry keys using the `reg.exe` utility. Adversaries may modify these keys to enable or disable BitLocker, potentially as a precursor to data encryption for impact (ransomware) or to facilitate data exfiltration by disabling encryption.
This rule identifies when a DNS Zone is either modified or deleted within Google Cloud Platform. This activity is captured through specific Google Cloud DNS API calls: 'Dns.ManagedZones.Delete', 'Dns.ManagedZones.Update', and 'Dns.ManagedZones.Patch'. Such actions can indicate malicious activity aimed at disrupting services or redirecting traffic, or legitimate administrative changes.
Detects file renames where the target filename uses an uncommon double extension. This behavior is often associated with ransomware activity, where files are encrypted and then renamed with a custom extension, such as ".jpg.crypted" or ".docx.locky". The rule specifically looks for common document and image file extensions followed by another extension, while filtering out known legitimate backup or temporary file extensions.
Detects specific command-line arguments used by the Conti ransomware during its execution phase. The rule looks for a combination of arguments including '-m ', '-net ', '-size ', '-nomutex ', and '-p \\', which are characteristic of Conti's encryption process. This pattern indicates the ransomware is likely attempting to encrypt files on the system or network shares.
Detects when an AWS EFS Fileshare is deleted. This action can indicate an attempt to disrupt availability or destroy data. Adversaries might delete file systems to impact operations or cover their tracks. Note that an EFS file system cannot be deleted if it has active mount targets, implying that mount targets would need to be deleted first.
Identifies when an ElastiCache security group has been modified or deleted.
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
Page 125 of 149