Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
508 detections
Filters
Last updated
All Time
Detection languages
365
63
28
27
9
Contributors
154
118
103
25
22
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
417
150
65
5
5
Products / Services
283
78
36
26
14
MITRE Techniques
149
134
128
121
88
CVEs
6
1
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects creation and movement of .lnk files to specific folders
Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.
Detects file renames where the target filename uses an uncommon double extension. This behavior is often associated with ransomware activity, where files are encrypted and then renamed with a custom extension, such as ".jpg.crypted" or ".docx.locky". The rule specifically looks for common document and image file extensions followed by another extension, while filtering out known legitimate backup or temporary file extensions.
Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.
Page 25 of 25