Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
20
7
5
2
1
Contributors
17
7
3
2
1
Categories
24
6
4
3
3
Platforms
32
6
4
1
Products / Services
11
4
3
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Detects execution of a SimpleRunPE-style loader from common user-writable directories such as Downloads, Temp, AppData, or Public paths. This behavior is often associated with malware attempting to evade detection by executing from non-standard locations.
Detects execution of a SimpleRunPE-style loader from Downloads, Temp, AppData, or Public paths.
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
Page 1 of 2