Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
684 detections
Filters
Last updated
All Time
Detection languages
430
131
28
27
26
Contributors
418
94
69
25
21
Categories
20,443
11,831
5,872
5,155
4,866
684
Platforms
653
44
16
10
5
Products / Services
105
89
33
22
13
MITRE Techniques
580
574
171
157
131
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects a burst of file modifications producing common
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns.
This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
Detects file system activity indicative of Royal and BlackSuit ransomware, specifically monitoring for the creation of ransom notes like 'README.TXT' or 'README.BlackSuit.txt' and mass renaming/encryption of files using extensions associated with these families (.royal, .royal_u, .blacksuit).
Detects VMware ESXi shell activity associated with the ShinySp1d3r encryptor. This includes the termination of VM processes via esxcli or vim-cmd, the deletion of VM snapshots, and suspicious file renaming or encryption activity on datastores consistent with ransomware behaviors.
Detects a suspicious pattern where a high volume of security, backup, or antivirus services and processes are terminated on a host in a short time window, followed by extensive file modification activity. This behavior is highly indicative of pre-encryption preparations by ransomware, specifically patterns observed by the Everest group, intended to neutralize defenses and prevent restoration before encrypting files.
Detects potential ransomware activity characterized by the mass renaming of files with specific extensions (.locked, .locked_wip) or the creation of known ransomware note filenames (RESTORE_FILES.txt) on a Windows system.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
This rule detects potential ransomware activity by correlating a rapid burst of file creation, modification, or renaming events across multiple directories with prior execution of defense evasion commands, such as deleting volume shadow copies or terminating security-related processes. This sequence is characteristic of ransomware operators attempting to disable recovery options and security protections before commencing mass file encryption.
Detects a suspected ransomware double-extortion sequence: the bulk creation of password-protected archives using compression utilities (e.g., 7z, RAR), followed by significant outbound network connections to common cloud storage or anonymization endpoints, and concluding with mass file modifications indicative of encryption activity.
Correlates a sequence of suspicious activities on a single host within 90 minutes: LSASS memory access consistent with credential dumping, followed by remote service or WMI-based lateral movement, and finishing with mass file renames or modifications characteristic of ransomware encryption.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects high-volume file rename and modification operations occurring across multiple directories, combined with the creation of files indicative of ransom notes (e.g., readme, decrypt, how-to-restore). This pattern is strongly associated with the encryption phase of a ransomware attack.
Detects a multi-stage extortion tactic where a host is targeted by a mass creation of initial decryption-style ransom notes across multiple directories, followed by a subsequent drop of distinct follow-up 'press release' or 'threat' notes within a 30-minute window, indicative of INC Ransom behavior.
Page 1 of 33