Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
20
14
3
1
Contributors
26
5
2
2
1
Categories
24
10
6
6
5
Platforms
38
9
5
5
3
Products / Services
13
9
6
5
4
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
This analytic detects the execution of the Windows built-in tool Fsutil.exe with the "behavior", "set" and "SymlinkEvaluation" parameters. Attackers can abuse this to alter symlink evaluation behavior on Windows, potentially enabling remote traversal over SMB shares or evading defenses. Such changes should be uncommon or even rare in enterprise environments and should be investigated.
KQL Query
KQL Query from file: Changes in SymlinkEvaluation Behavior via fsutil
Detects changes to the "MaxMpxCt" registry value, which specifies the maximum outstanding network requests for the server per client when negotiating an SMB connection. Ransomware threat actors, specifically BlackCat, have been observed increasing this value to handle a higher volume of traffic, potentially for data exfiltration or other high-volume network activities.
Detects the execution of "DirLister.exe", a utility used by the BlackCat ransomware group to enumerate files and directories on a compromised system. This tool helps adversaries quickly map out the file system for further malicious activities like data exfiltration or encryption.
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Yara rule that detects BlackCat ransomware.
Page 2 of 2