Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
18
13
9
4
2
Contributors
27
6
4
2
1
Categories
33
15
6
5
5
Platforms
45
4
1
1
Products / Services
19
16
6
4
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects anomalous authentication behavior originating from a single source IP targeting an SSL VPN gateway. The rule identifies a high volume of unique usernames failing authentication within a short time window, a pattern indicative of password spraying and often associated with initial access attempts on environments lacking multi-factor authentication (MFA), such as those leveraged in Akira ransomware operations.
Detects the execution of rclone.exe or renamed binaries with command-line flags indicative of data exfiltration to cloud storage providers such as S3, Mega, OneDrive, or Google Drive. This behavior is frequently associated with ransomware actors, including Akira, Qilin, and Storm-2570, who use Rclone to perform mass exfiltration of sensitive file share data prior to encryption (double extortion).
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
This rule detects anomalous authentication behavior on SonicWall VPN appliances characterized by either multiple distinct source IP addresses for a single user or a high volume of failed authentication attempts followed by a successful login. These patterns are often indicative of credential stuffing or password spraying campaigns, such as those observed in Akira ransomware affiliate initial access activities.
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'Safe Mode with Networking'. This behavior is commonly observed as an evasion technique used by threat actors, including Akira ransomware affiliates, to bypass EDR protections during pre-ransomware staging activities.
Detects the modification of boot configuration data (BCD) using bcdedit to enable 'Safe Mode with Networking' on the next reboot. Adversaries, including Akira ransomware affiliates, use this technique to bypass endpoint detection and response (EDR) solutions by ensuring they do not start when the system boots in a restricted safe mode.
Detects successful remote authentication events originating from an external source IP address via a SonicWall SSL-VPN, as identified by relevant login fields. This rule serves as a proxy for identifying initial access attempts often associated with ransomware activity, such as Akira, which leverage compromised VPN credentials.
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
Detects the use of the native Windows utility 'wbadmin.exe' to initiate a backup procedure targeting the Active Directory database (NTDS.dit) and associated registry hives (SYSTEM, SECURITY). This technique is utilized by adversaries for offline credential harvesting by extracting the directory database file. This behavior has been observed in intrusion campaigns involving ransomware actors like Akira.
Detects when bcdedit or bootcfg is executed and Safeboot registry keys modified within a specified time window
Detects the deletion of Volume Shadow Copies using native Windows utilities like WMIC or PowerShell cmdlets (Get-WmiObject, Get-CimInstance) targeting Win32_ShadowCopy. This behavior is a common indicator of ransomware preparation to inhibit system recovery prior to encryption, as observed in attacks involving the Akira ransomware.
Detects the execution of 'net.exe' from a 'powershell.exe' parent process to either reset the local administrator password or reactivate a built-in domain administrator account. This behavior is associated with the Akira ransomware group's pre-encryption stage to ensure access to compromised endpoints.
Detects the execution of commands to disable Microsoft Defender (specifically Set-MpPreference or stopping the WinDefend service) within 10 minutes of the first interactive user login on a host. This behavior is indicative of threat actors, such as Akira ransomware affiliates, performing anti-forensics and disabling security controls on newly provisioned or compromised systems.
Detects suspicious activity associated with the AdaptixC2 framework, specifically process hollowing or shellcode injection where WmiPrvSE.exe spawns or creates remote threads in WAB.exe (Windows Address Book). This pattern has been observed in Akira ransomware intrusions.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
Detects the execution of wbadmin.exe to initiate a backup that specifically targets the NTDS.dit database and registry hives (SYSTEM, SECURITY), then stages them to a path on C:\ProgramData. This pattern is characteristic of credential dumping activities associated with the Akira ransomware, enabling offline extraction of domain credentials.
Page 1 of 3