Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Detects the use of the 'shutdown.exe' command-line tool with the '/l' argument, which is used to log off the current user. This activity is considered rare and potentially suspicious as it can be used by adversaries to disrupt user sessions or as part of system manipulation tactics.
Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Detects the use of the built-in Windows utility 'cipher.exe' with the '/w:' argument to overwrite deleted data on disk. This technique is often used by adversaries to destroy data and files, making them irrecoverable by forensic methods, thereby impacting system availability.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
This rule detects suspicious invocations of the `fsutil.exe` utility, specifically when it's used to delete the USN journal, create a USN journal with a small size, or set zero data to a file. These actions are often associated with ransomware or other malicious activity aimed at defense evasion and data destruction, as seen in campaigns like NotPetya and Lockbit.
Detects a command that accesses the Volume Shadow Copy to extract sensitive files such as the Security or SAM registry hives or the Active Directory database (ntds.dit). This activity is often associated with credential dumping.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the usage of 'schtasks.exe' with the '/delete' flag and the '/tn *' argument, which is used to delete all scheduled tasks on a local Windows system, including those created by other users. This activity can be indicative of an adversary attempting to disrupt system operations or remove forensic evidence.
Detects the execution of Sysinternals SDelete to overwrite a specific file, rather than its intended use of wiping free space or entire volumes. This activity is indicative of an adversary attempting to destroy data to prevent recovery or forensic analysis.
Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Detects the execution of the built-in 'copy' command targeting a Volume Shadow Copy. This technique is often used by adversaries to exfiltrate sensitive files, such as registry hives, that are actively in use and locked by the operating system. By copying from a shadow copy, adversaries can bypass file locks and access system-critical data.
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt by adversaries to bypass parent/child relationship detection or application whitelisting rules by using Diskshadow.exe to proxy execution of other binaries like certutil.exe, powershell.exe, or rundll32.exe. This technique is often used for defense evasion and can be part of credential access or data exfiltration attempts.
Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
Detects the execution of the 'gpg.exe' utility when its filename has been changed. Adversaries, particularly ransomware and loaders, often rename legitimate tools like GnuPG to evade detection while using them for encryption or decryption operations.
Detects the use of the WMI class "Win32_NTEventlogFile" with methods that can be used to manipulate event logs, such as deleting, backing up, or changing permissions. This activity, especially when originating from a PowerShell script, can be indicative of an adversary attempting to evade detection or inhibit system recovery.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
Page 127 of 149