Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
5
Contributors
3
2
Categories
3
2
2
1
1
Platforms
4
1
Products / Services
2
2
2
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
'This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.