Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,161
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects network connections to remote URLs containing specific keywords ('festung', 'germania', 'deutsch', 'prinz', 'eugen') that are indicative of Germany-themed infrastructure potentially associated with the Prinz Eugen Ransomware. This helps identify early communication with command and control servers or data exfiltration points.
This rule detects process execution where the command line contains keywords indicative of inline assembly or native code injection (e.g., 'shellcode', 'payload', 'bytecode', 'native', 'runtime') and the process is one of several common executables ('servertool.exe', 'encrypt.exe', 'powershell.exe', 'cmd.exe'). This behavior is often associated with malware, including ransomware, attempting to execute malicious code.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.
Detects the creation or modification of registry run keys that establish persistence for the Prinz Eugen ransomware. The rule specifically looks for registry entries under 'Software\Microsoft\Windows\CurrentVersion\Run' that contain common environment variables (e.g., %APPDATA%, %TEMP%) and specific filenames or paths associated with Prinz Eugen ransomware (e.g., 'servertool', 'encrypt.exe', '\Music\', '\Desktop\').
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
This rule detects a suspicious sequence of events indicative of ransomware activity, specifically the Prinz Eugen ransomware. It looks for the execution of common file compression utilities (7z.exe, rar.exe, WinRAR.exe, winzip.exe) followed by the execution of known ransomware encryption executables (servertool.exe, encrypt.exe) on the same device within a 30-minute window. This pattern suggests that an attacker is compressing files before encrypting them, a common tactic to reduce the size of data for faster encryption or exfiltration.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
Detects execution of a SimpleRunPE-style loader from Downloads, Temp, AppData, or Public paths.
Detects a miner or renamed executable running from a suspicious directory structure within ProgramData with mining command-line characteristics.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
Detects a miner or renamed executable running from a hidden-looking ProgramData directory with mining command-line characteristics. This often indicates cryptojacking activity where an attacker is using system resources for cryptocurrency mining without authorization.
Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable. This rule specifically looks for process creation events where the executable name is 'obs-check-update' and the file path is within '/tmp/obsHub/' or '/var/tmp/obsHub/'.
Page 127 of 232