Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
13
8
6
3
3
Contributors
32
2
1
Categories
19
13
9
7
6
Platforms
34
2
Products / Services
21
16
4
3
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
This rule detects modifications to the Image File Execution Options (IFEO) registry key for the agent service 'agntsvc.exe'. It identifies when an adversary configures a 'Debugger' registry value or a specific systray-related value, which is a known behavior of the Pay2Key ransomware for persistence and potential privilege escalation or process interference.
Detects execution of PowerShell commands associated with the Pay2Key ransomware, specifically searching for command lines that reference bin-staged payloads (data1.bin, data2.bin, data3.bin) and a hardcoded XOR key (12199) used to deobfuscate the payloads in memory before execution via Invoke-Expression or similar methods.
This rule detects known evasion techniques used by the Pay2Key and Grixba malware families. It identifies timing-based delays triggered by malicious 'ping.exe' commands targeting invalid IP addresses and locale-based geofencing checks performed via registry queries for custom locale settings.
Detects Pay2Key ransomware attempting sandbox evasion by executing the Windows timeout utility with a 10-second delay, initiated from the SysWOW64 command prompt.
Detects behavior consistent with the Pay2Key ransomware, which checks for the presence of Avast security software directories, verifies SYSTEM account access via registry queries, and performs subsequent DLL sideloading by dropping 'powrprof.dll' into the Avast application folder.
Detects reconnaissance activity associated with Pay2Key ransomware, specifically sandbox or environment checks. This includes process lineage originating from 7ZipSfx temporary directories combined with registry queries for S-1-5-19 (SYSTEM account) or direct file system access to Avast installation directories to verify the presence of security software.
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Detects a suspicious self-deletion pattern associated with the Pay2Key ransomware, where an SFX dropper uses cmd.exe to execute a ping-based delay followed by fsutil to zero out the original dropper file, and subsequently performs mass deletion of remaining .exe and .bat files.
This rule monitors for specific registry modifications to the Windows LegalNoticeText key, which is a known behavior of Pay2Key ransomware to display ransom notes to the user upon logon.
Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.
Detects the modification of the 'LegalNoticeText' registry value to display Pay2Key ransomware-related strings. This activity is indicative of a system being targeted or compromised by the Pay2Key ransomware, which uses this registry key to display a ransom message upon user logon.
Detects a suspicious PowerShell execution pattern observed in Pay2Key ransomware, where PowerShell attempts to read and execute the contents of a setup.cmd file (referred to by environment variable) using [io.file]::ReadAllText and iex.
Detects Pay2Key ransomware activity involving the extraction of suspicious DLLs into the Avast installation directory and the subsequent loading of these unsigned/unauthorized DLLs by legitimate Avast processes. This rule covers the file creation of known malicious DLL names, the use of 7za.exe for extraction into the directory, and the process module load events for unsigned DLLs within the Avast scope.
Detects Pay2Key ransomware establishing persistence by modifying the HKLM Run registry key to execute a browser.exe file located in a GUID-named subdirectory within AppData\Local.
Detects the Pay2Key ransomware's reconnaissance behavior of probing the Avast Software installation directory using a 7-Zip self-extracting executable as a precursor to performing DLL sideloading of a malicious powrprof.dll file.
Detects the Pay2Key ransomware's use of a polyglot setup.cmd script that executes embedded PowerShell code in-memory. The detection focuses on PowerShell being launched with the '-nop' flag and a specific pattern using [io.file]::ReadAllText($env:0) to read and execute the script's own content, a technique characteristic of Pay2Key's fileless execution.
Detects the use of 7za.exe, executed from temporary 7ZipSfx directories, to extract encrypted data (data2.bin) into the Avast Software directory. This activity is indicative of the Pay2Key ransomware attempting to perform DLL sideloading by dropping a malicious DLL, such as powrprof.dll, into a legitimate application folder to hijack execution flow.
Detects a registry modification where the Image File Execution Options (IFEO) 'Debugger' value for the agent service process 'agntsvc.exe' is set to 'Systray.exe'. This technique is used by the Pay2Key ransomware to hijack the process execution flow, potentially to impair security or backup services.
Detects a registry modification where Pay2Key ransomware sets the 'shutdownwithoutlogon' value to 0 under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. This action disables the shutdown option in the Windows Start menu, a tactic used by the ransomware to maintain access to the infected system and ensure encryption processes are not interrupted by a reboot.
Detects the Pay2Key ransomware displaying a ransom note by spawning notepad.exe to open a file named 'HowToRestoreFiles.txt' located in the 'C:\temp\' directory, typically as a result of execution from registry persistence keys.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Page 1 of 2