Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
1
1
1
1
Categories
1
1
1
1
1
Platforms
3
1
Products / Services
1
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
KQL Query from file: Outlook New Requirements for High‐Volume Senders
Get all filtering events done by the Windows filtering platform.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This YARA rule detects the Ragnarok ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code sections responsible for finding files, encrypting files, disabling the firewall, and deleting shadow volumes, which are common behaviors of ransomware.
