Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
Products / Services
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the modification of file permissions on critical Windows boot files (bootmgr, ntoskrnl.exe, winload.exe, winload.efi, winload) using `takeown.exe` or `icacls.exe`. This activity is a known precursor to BLUERABBIT's destructive wiping phase, where it attempts to render systems unbootable.
Detects network connections to known XWorm Command and Control (C2) infrastructure (IPs and domains) and the creation of processes with filenames associated with XWorm malware. This rule combines network and process-based indicators to identify potential XWorm infections.
