Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects unauthorized creation or modification of AI agent system prompts, guardrails, or policy configuration files. This rule monitors for changes made by processes or users other than those identified as authorized CI/CD deployment agents or service accounts, helping to prevent unauthorized tampering with AI agent behavior or safety policies.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Detects a suspicious volume of cloud resource deletions occurring within a short 15-minute window, specifically targeting multiple storage accounts and SQL database/server instances. This behavior is indicative of a malicious actor or an automated script attempting to disrupt business operations or destroy data.
Detects the use of legitimate Windows administrative tools (vssadmin, wmic, wbadmin, bcdedit, sc, net) to delete volume shadow copies, clear backup catalogs, disable boot recovery options, or stop critical backup and system services. This behavior is highly characteristic of ransomware activity aiming to prevent data restoration and system recovery.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
Detects a suspicious burst of commands commonly used to disable security services, antivirus, or backup agents on a single host. The rule monitors for a high frequency of taskkill, net stop, sc stop, or PowerShell Stop-Service operations targeting a predefined list of sensitive security software process and service names within a short timeframe, which is a common precursor to ransomware encryption.
Detects anomalous AWS Bedrock model invocation patterns where a single identity accesses models across three or more distinct AWS regions within a short timeframe. This behavior is indicative of quota evasion, where attackers bypass per-region rate limits to maximize throughput when leveraging compromised credentials for unauthorized LLM use.
Detects the creation of high-cost, resource-intensive compute instances (such as GPU-enabled or large-scale VMs) within cloud regions that have not been previously utilized by the account, subscription, or project. This behavior is often indicative of unauthorized resource hijacking, such as crypto-mining or large-scale data processing by threat actors.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
Detects the execution of known PAYLOAD ransomware process-termination utilities (killer.exe or kill.exe). These tools are used by adversaries to forcefully terminate security software, backup services, and database processes prior to file encryption.
Detects the execution of files ending in '_win64.exe' from 'Perflogs' or 'Documents' directories, which is a known behavior of the Settra ransomware. The rule filters out common system and program file paths to reduce noise.
Detects the use of native Windows utilities (vssadmin.exe, wmic.exe, wbadmin.exe, bcdedit.exe) to delete volume shadow copies, backup catalogs, or modify boot configuration data to inhibit system recovery, a common behavior observed during ransomware and wiper attacks.
Detects evidence of cryptocurrency mining (XMRig) and suspicious process masquerading on Linux systems, alongside container-related events referencing known malicious or suspicious strings such as 'GH0ST_C2' or 'fsociety'.
Detects the use of native Windows utilities (vssadmin, wbadmin, bcdedit, wmic) to delete shadow copies, backup catalogs, or modify boot configuration data to disable recovery. This behavior is commonly associated with ransomware and data destruction attacks intended to prevent system restoration.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a burst of file delete or overwrite operations initiated by a configured AI agent service identity. This behavior, if deviating from established baselines, may indicate a compromised agent performing malicious destructive activities such as mass data deletion or ransomware-style file destruction.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Page 7 of 149