Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
506 detections
Filters
Last updated
All Time
Detection languages
174
86
73
69
35
Contributors
147
94
79
59
32
Categories
376
347
319
94
91
Platforms
491
8
7
3
2
Products / Services
10,670
9,758
6,693
4,421
3,749
506
MITRE Techniques
333
272
136
126
104
CVEs
3
3
1
1
IDS Classtypes
8
3
2
1
IDS Protocols
9
5
WMI Persistence
Sigma
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Page 25 of 25