Browse Rules

Search and filter across all detection sources

9,325 rules

sentinel high kql

Filewall - Blocked files

Identifies files blocked by Filewall for Microsoft 365 (SharePoint/OneDrive/Teams).
sentinel medium kql

Trend Micro CAS - Unexpected file on file share

'Detects unexpected files on file share.'

wazuh low xml

Cylance: File $(cylance_events.filepath) is abnormal.

Cylance: File $(cylance_events.filepath) is abnormal.
wazuh informational xml

The file limit set for this agent is $(file_limit). Now, $(file_count) files are being monitored.

The file limit set for this agent is $(file_limit). Now, $(file_count) files are being monitored.
wazuh informational xml

Cylance Event: File $(cylance_events.filepath) is waived.

Cylance Event: File $(cylance_events.filepath) is waived.
signature-base unknown yara

asp_file [yara]

Laudanum Injector Tools - file file.asp
signature-base unknown yara

php_file [yara]

Laudanum Injector Tools - file file.php
chronicle high yara-l

VT Relationships File Executes File

Alert on known File Hash executing known File Hash with VT Relationships.
sagan critical other

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)
sagan critical other

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)
sagan critical other

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)
sagan critical other

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)

[WINDOWS-MALWARE] Evil ransomware file extension detected (.file0locked)
sagan critical other

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)
sagan critical other

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)
sagan critical other

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)
sagan critical other

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)

[WINDOWS-MALWARE] FileLocker ransomware file extension detected (.encr)
yara unknown yara

asp_file [webshells]

Laudanum Injector Tools - file file.asp
yara unknown yara

File_Analyzer_Registration_file_v10_Hint_FILE_START [packers]
yara unknown yara

File_Analyzer_Registration_file_v11_Hint_FILE_START [packers]
yara unknown yara

php_file [webshells]

Laudanum Injector Tools - file file.php
sagan critical other

[WINDOWS-SYSMON] JavaScript file executed after batch file

[WINDOWS-SYSMON] JavaScript file executed after batch file
wazuh informational xml

Cylance Threat: File $(cylance_threats.file_path) is waived

Cylance Threat: File $(cylance_threats.file_path) is waived
wazuh low xml

Cylance Threat: File $(cylance_threats.file_path) is abnormal

Cylance Threat: File $(cylance_threats.file_path) is abnormal
sigma high sigma

Suspicious File Download From File Sharing Websites - File Stream

Detects the download of suspicious file type from a well-known file and paste sharing domain
sigma medium sigma

Unusual File Download From File Sharing Websites - File Stream

Detects the download of suspicious file type from a well-known file and paste sharing domain