Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects activity associated with Everest ransomware by matching known file hashes (in DeviceFileEvents/DeviceProcessEvents) and known C2/leak-site domains (in DeviceNetworkEvents).
Detects activity associated with Everest ransomware by matching known file hashes (in DeviceFileEvents/DeviceProcessEvents) and known C2/leak-site domains (in DeviceNetworkEvents).
Detects activity associated with Everest ransomware by matching known file hashes (in DeviceFileEvents/DeviceProcessEvents) and known C2/leak-site domains (in DeviceNetworkEvents).
Detects attempts to perform a Denial of Service (DoS) attack against an AI-enabled system by flooding the inference API with high volumes of requests or overly large inputs (high token counts). The rule identifies potential resource exhaustion by correlating high request rates or large input sizes with system-wide impacts, such as increased inference queue depth or excessive GPU utilization, which could impede service availability for other users.
Detects the use of 'vim-cmd' or 'esxcli' to power off or terminate virtual machine processes on an ESXi host, which may indicate malicious activity such as ransom-related VM shutdown or service disruption.
Detects the creation of files commonly associated with ransomware notes (e.g., README.txt, HOW_TO_DECRYPT.txt) across multiple directories, which is a strong indicator of the impact phase where files have been encrypted and the adversary is providing recovery instructions.
Detects high-velocity, automated-paced burst of deletion operations spanning multiple distinct Azure resource types (Storage, SQL, Key Vault, Web Sites) within a 15-minute window. This behavior is indicative of agentic AI-orchestrated cloud resource destruction, contrasting with typical administrative lifecycle management.
Detects the use of legitimate Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to prevent automatic system recovery. This behavior is a common indicator of ransomware preparing for encryption by removing local recovery options.
Detects anomalous bursts of deletion activity targeting Azure Site Recovery and Backup resources, including management locks and backup policies. This behavior is consistent with an adversary attempting to inhibit system recovery capabilities, often a precursor to destructive activities such as ransomware deployment. The rule also correlates this activity with the deletion of other critical infrastructure components like databases or storage accounts.
Detects attempts to delete Azure resource locks protecting Site Recovery or Backup services, followed by credential retrieval (ListKeys) within a one-hour window. This sequence pattern is a strong indicator of an adversary attempting to disable backup protection before potentially destroying data or exfiltrating keys.
This rule detects potential ransomware activity by correlating a rapid burst of file creation, modification, or renaming events across multiple directories with prior execution of defense evasion commands, such as deleting volume shadow copies or terminating security-related processes. This sequence is characteristic of ransomware operators attempting to disable recovery options and security protections before commencing mass file encryption.
Detects the disabling of the built-in 'Administrator' account initiated by a system-level process (e.g., service or background task), which is characteristic of GPO enforcement or malicious tampering.
Detects execution of common Windows utilities used by adversaries post-encryption to hinder system recovery and clear forensic evidence. This includes disabling the Windows Recovery Environment (ReAgentC), wiping disk free space (Cipher), clearing DNS caches, and clearing Windows Event Logs via Wevtutil or PowerShell.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects the provisioning of high-performance compute instances (GPU or high-CPU) in AWS regions that fall outside of an established organizational baseline. This behavior is often associated with unauthorized resource hijacking (cryptomining) by adversaries leveraging compromised IAM principals to deploy infrastructure in regions with lower visibility or monitoring coverage.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects the mass creation of high-performance compute instances (GPU or high-memory variants) in an AWS environment. By filtering out legitimate service-linked roles associated with auto-scaling, the rule isolates potentially unauthorized manual provisioning, often indicative of cryptojacking or resource hijacking.
Detects the execution of native Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit used to delete volume shadow copies, the backup catalog, or disable system recovery boot policies. This activity is a common precursor to ransomware encryption to prevent data restoration.
Detects a suspected ransomware double-extortion sequence: the bulk creation of password-protected archives using compression utilities (e.g., 7z, RAR), followed by significant outbound network connections to common cloud storage or anonymization endpoints, and concluding with mass file modifications indicative of encryption activity.
Detects modifications, creations, or deletions of critical CI/CD pipeline configuration files (GitHub Actions, GitLab CI, Jenkins, Azure Pipelines) across cloud service logs. The rule correlates these actions with the account's historical IP baseline to identify potentially unauthorized changes originating from anomalous locations.
Correlates a sequence of suspicious activities on a single host within 90 minutes: LSASS memory access consistent with credential dumping, followed by remote service or WMI-based lateral movement, and finishing with mass file renames or modifications characteristic of ransomware encryption.
Page 8 of 149