Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
6
3
3
2
Contributors
3
2
2
2
1
Categories
5
5
3
2
2
Platforms
14
1
1
1
Products / Services
5
2
2
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects Microsoft Defender AV alerts associated with the GigaWiper signature, indicating the presence of the GRAT wiper component deployed by Cyber Isnaad Front.
Detects the usage of the 'fsutil' command line tool to create a massively sized file explicitly named 'DiskFillerFile' to exhaust available disk space. This technique was observed in the Lotus Wiper destructive campaign to corrupt system operations and complicate recovery efforts.
Detects attempts to query, stop, or disable the legacy UI0Detect (Interactive Services Detection) service using the 'sc.exe' utility. This behavior was observed in the Lotus Wiper destructive campaign to suppress interactive service warnings before wiping the system.
Detects attempts to query, stop, or disable the legacy Interactive Services Detection (UI0Detect) service using the 'sc.exe' utility. This technique was observed in the Lotus Wiper destructive campaign to suppress interactive service graphical warnings before executing its wiper payload.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects execution or presence of DYNOWIPER-related files by matching the published SHA256 hashes from the Elastic Security Labs DYNOWIPER report.
This rule detects activity associated with the DYNOWIPER malware. It identifies the malware through specific SHA256 file hashes, known filenames (dynacom_update.exe, source.exe, schtask.exe, dynacon_update.ps1, exp.ps1), and process names (dynacom_update.exe, source.exe, schtask.exe, powershell.exe). Additionally, it flags network connections to or from a set of known malicious IP addresses (185.200.177.10, 31.172.71.5, 193.200.17.163, 185.82.127.20, 72.62.35.76) which are associated with VPN logins or exfiltration reverse proxies used by DYNOWIPER.
The analytic identifies a high frequency of file deletions by monitoring Sysmon EventCodes 23 and 26 for specific file extensions. This detection leverages Sysmon logs to track deleted target filenames, process names, and process IDs. Such activity is significant as it often indicates ransomware behavior, where files are encrypted and the originals are deleted. If confirmed malicious, this activity could lead to extensive data loss and operational disruption, as ransomware can render critical files inaccessible, demanding a ransom for their recovery.
This rule detects the PathWiper trojan by identifying specific byte patterns associated with its functionality. The patterns indicate the malware's capabilities to find volumes, enumerate files, discover shared network drives, and overwrite files, which are characteristic behaviors of wiper malware.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
This analytic detects the deletion of registry keys by processes that are not typically associated with critical system or program files. This activity is significant as it may indicate malware, such as the Double Zero wiper, attempting to evade defenses or cause destructive payload impacts. If confirmed malicious, this behavior could lead to significant system damage, loss of critical configurations, and potential disruption of services.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
This YARA rule detects the BiBiWiper trojan by identifying specific byte sequences associated with its shadow copy deletion and file destruction functionalities. The rule looks for two distinct patterns, '$delete_shadow_copies_p*' and '$destroy_files_p*', which are indicative of the malware's destructive behavior. The presence of both sets of patterns within a file, combined with the MZ header (0x5A4D), triggers the detection.