Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
1
1
Platforms
2
Products / Services
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
'Summarizes uses of uncommon & undocumented commandline switches to create persistence
User accounts may be created to achieve persistence on a machine.
Read more here: https://attack.mitre.org/wiki/Technique/T1136
Query for users being created using "net user" command
"net user" commands are noisy, so needs to be joined with another signal -
e.g. in this example we look for some undocumented variations (e.g. /ad instead of /add)'
User accounts may be created to achieve persistence on a machine.
Read more here: https://attack.mitre.org/wiki/Technique/T1136
Query for users being created using "net user" command
"net user" commands are noisy, so needs to be joined with another signal -
e.g. in this example we look for some undocumented variations (e.g. /ad instead of /add)'