Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
12
11
4
3
1
Contributors
11
10
4
3
1
Categories
11
8
6
5
4
Platforms
31
2
2
Products / Services
12
7
6
5
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects network connections to known REvil ransomware domains
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
Detects the use of PowerShell to re-enable the deprecated and vulnerable SMB1 protocol. This protocol is often used by attackers for lateral movement to legacy systems, as highlighted by groups like The Gentlemen RaaS.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
The analytic detects the use of `bitsadmin.exe` with the `transfer` or `addfile` parameters to download a remote object. This activity is significant because `bitsadmin.exe` can be exploited to download and execute malicious files without immediate detection. If confirmed malicious, an attacker could use this technique to download and execute payloads, potentially leading to code execution, privilege escalation, or persistent access within the environment. The rule leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Review parallel and child processes, especially `svchost.exe`, for associated artifacts.
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
The following analytic detects the usage of `rclone.exe` with specific command-line arguments indicative of file transfer activities. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as `rclone.exe` is often used by adversaries for data exfiltration, especially during ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and potential loss of sensitive information. Immediate isolation of the affected endpoint and further investigation are recommended.
The following analytic detects the modification of firewall settings to allow file and printer sharing. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving 'netsh' commands that enable file and printer sharing. This activity is significant because it can indicate an attempt by ransomware to discover and encrypt files on additional machines connected to the compromised host. If confirmed malicious, this could lead to widespread file encryption across the network, significantly increasing the impact of a ransomware attack.
The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
This analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
Detects the creation of files with executable or script extensions by Microsoft Office applications. This behavior can indicate an attempt to drop and execute malicious code, often associated with initial access or execution phases of an attack. The rule specifically looks for common Office applications creating files with extensions like .exe, .dll, .ps1, .vbs, etc., while filtering out known legitimate activities.
Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. The rule specifically looks for signatures containing common ransomware family names and keywords.
This rule detects attempts to delete Windows Volume Shadow Copies using PowerShell commands that interact with WMI (Windows Management Instrumentation). Specifically, it looks for PowerShell scripts containing `Get-WmiObject`, `gwmi`, `Get-CimInstance`, or `gcim` in conjunction with `Win32_ShadowCopy` and a deletion method like `.Delete()`, `Remove-WmiObject`, `rwmi`, `Remove-CimInstance`, or `rcim`. This technique is commonly employed by ransomware families, such as Sodinokibi/REvil, to prevent system recovery.
The following analytic detects the modification of registry keys related to the desktop wallpaper settings. It leverages Sysmon EventCode 13 to identify changes to the "Control Panel\\Desktop\\Wallpaper" and "Control Panel\\Desktop\\WallpaperStyle" registry keys, especially when the modifying process is not explorer.exe or involves suspicious file paths like temp or public directories. This activity is significant as it can indicate ransomware behavior, such as the REVIL ransomware, which changes the wallpaper to display a ransom note. If confirmed malicious, this could signify a compromised machine and the presence of ransomware, leading to potential data encryption and extortion.
This analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems.
The following analytic detects a suspicious process loading a COM object from wbemprox.dll, fastprox.dll, or wbemcomn.dll. It leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes not typically associated with them, excluding known legitimate processes and directories. This activity is significant as it may indicate an attempt by threat actors to abuse COM objects for privilege escalation or evasion of detection mechanisms. If confirmed malicious, this could allow attackers to gain elevated privileges or maintain persistence within the environment, posing a significant security risk.
The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. It leverages the Endpoint.Filesystem datamodel to identify instances where these files are created outside their expected directories. This activity is significant because it is associated with the REvil ransomware, which uses DLL side-loading to execute malicious payloads. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system compromise, and potential data loss or extortion.
The analytic identifies suspicious modifications in the registry entry, specifically targeting paths used by malware like REVIL. It detects changes in registry paths such as `SOFTWARE\WOW6432Node\Facebook_Assistant` and `SOFTWARE\WOW6432Node\BlackLivesMatter`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications linked to process GUIDs. This activity is significant as it indicates potential malware persistence mechanisms, often used by advanced persistent threats (APTs) and ransomware. If confirmed malicious, this could allow attackers to maintain persistence, encrypt files, and store critical ransomware-related information on compromised hosts.
Page 1 of 2