Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
18
13
9
4
2
Contributors
27
6
4
2
1
Categories
33
15
6
5
5
Platforms
45
4
1
1
Products / Services
19
16
6
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
This detection identifies the use of two drivers, rwdrv.sys and hlpdrv.sys, which have been observed in Akira ransomware campaigns. The activity includes dropping these drivers, creating associated services, and disabling Windows Defender.
Detects the creation of files and services associated with malicious drivers (hlpdrv.sys, rwdrv.sys) used by Akira ransomware affiliates for defense evasion, as reported by GuidePoint Security. This rule specifically looks for the creation of these driver files and the associated service registrations in the Windows Registry.
Detects the execution of the "cloudflared" tool with command-line arguments indicative of establishing or running a tunnel. This activity has been observed in post-compromise scenarios by threat actors, such as the Akira ransomware group, to maintain persistence and remote access to compromised networks by creating covert communication channels.
Detects the execution of the Cloudflared Quick Tunnel utility, which can be used by adversaries to establish tunnels for various services like HTTP, RDP, SSH, and SMB. This tool has been observed in use by threat groups, including Akira ransomware, to create ad-hoc tunnels that generate random subdomains on trycloudflare.com.
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
This rule detects the execution of the 'cloudflared.exe' binary from any location other than the standard installation paths ('Program Files (x86)\cloudflared\' or 'Program Files\cloudflared\'). Adversaries often use portable versions of legitimate tools like Cloudflared for command and control (C2) or data exfiltration, executing them from non-standard directories to evade detection. This behavior is frequently observed in ransomware campaigns, such as those by Akira, where Cloudflared is leveraged to establish tunnels for malicious traffic.
Page 3 of 3