Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.