Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
3
1
Contributors
5
1
1
1
1
Categories
6
5
1
1
1
Platforms
7
2
1
Products / Services
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects various post-exploitation activities associated with the Amadey loader, including the execution of its persistence mechanism (nudwee.exe), dropping and executing secondary payloads in temporary directories, using PowerShell download cradles, creating scheduled tasks for persistence, and silent MSI installations. This rule aims to identify the delivery of secondary payloads like StealC and Lumma Stealer.
KQL Query from file: Endpoint SMB Exposed on Public Internet
This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor
The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies. This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes. If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
This YARA rule detects the KillDisk ransomware based on specific byte patterns found in its executable code. It looks for patterns related to file encryption routines and application whitelisting mechanisms, which are characteristic of KillDisk variants. The rule requires all three defined string patterns to be present in a PE file (indicated by the 'MZ' header) for a match.
This YARA rule detects the Satana ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p1, $encrypt_files_p2) indicative of how the ransomware encrypts files, patterns related to how it searches for files ($search_files_p1, $search_files_p2), and byte sequences involved in establishing remote connections ($remote_connection). The rule requires the presence of the remote connection patterns, along with all file searching and file encryption patterns, to trigger a detection, ensuring a high confidence in identifying Satana ransomware.
Yara rule that detects KillDisk ransomware.
Yara rule that detects KillDisk ransomware.