Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects attempts to read the 'Groups.xml' file within the SYSVOL share. This file can contain sensitive credential information if Group Policy Preferences were used to deploy local user accounts or services, as the passwords might be stored in a decryptable format. Adversaries often target this file to extract credentials.
This YARA rule detects the JSWorm ransomware by identifying specific byte patterns associated with its file finding, drive enumeration, and file encryption routines. The rule looks for a combination of these patterns within executable files (MZ header check).
