Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the creation of temporary '.tmp' files starting with 'Hid' in the user's temporary directory, which is indicative of the PoisonX dropper deploying its driver. This behavior is associated with the initial stages of PoisonX malware execution.
KQL Query
This YARA rule detects various versions of the CryptoWall ransomware based on specific byte patterns found at the entry point and within API loading, hash calculation, file finding, and file encryption routines. It targets both version 2.0 and 3.0 variants of the ransomware by looking for distinct code sequences indicative of their malicious functionality.
