Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
2
2
2
1
1
Platforms
4
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
Detects the creation of temporary files associated with Advanced IP Scanner, a tool often used by ransomware groups for network discovery. This rule specifically looks for the creation of files within the user's temporary directory that contain the string '\AppData\Local\Temp\Advanced IP Scanner 2'.
This rule detects PowerShell scripts that enumerate directories using `Get-ChildItem` and output the results to a file using `Out-File -append`. The detection logic specifically looks for the combination of `foreach`, `Get-ChildItem`, `-Path`, `-ErrorAction SilentlyContinue`, `Out-File`, and `-append` within the PowerShell script block text. This behavior has been associated with MAZE ransomware for directory discovery.
Detects specific process characteristics associated with Maze ransomware droppers. This includes a temporary file being executed as a child process of WINWORD.exe, and the execution of wmic.exe to delete shadow copies, which is a common tactic for ransomware to inhibit system recovery.