Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
14
11
8
6
4
Contributors
23
8
5
2
2
Categories
29
13
7
7
6
Platforms
43
6
1
Products / Services
17
16
6
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
1
1
IDS Protocols
4
1
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects the use of the bcdedit.exe utility to configure the Windows boot configuration to enter Safe Mode (minimal or with networking), immediately followed by the execution of a shutdown command with the reboot flag. This sequence is a known technique utilized by Akira ransomware affiliates to force a system reboot into a restricted environment where security agents and endpoint detection and response (EDR) tools may fail to load, allowing for undetected encryption.
Detects network traffic indicating the use of Rclone to exfiltrate data to MEGA cloud storage, a technique associated with Akira ransomware campaigns.
Detects unauthorized modification or creation of registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ to maintain persistence for remote access/RMM tools during Safe Mode with Networking. This technique is used by Akira ransomware affiliates to evade EDR and security software.
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'Safe Mode with Networking'. This behavior is commonly observed as an evasion technique used by threat actors, including Akira ransomware affiliates, to bypass EDR protections during pre-ransomware staging activities.
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
Detects the execution of psql.exe to query the Veeam Backup & Replication PostgreSQL database for stored credentials. This pattern is associated with credential theft techniques utilized during ransomware operations (e.g., Bumblebee, Akira) where sensitive configuration or credential data is retrieved and potentially later decrypted via DPAPI.
Detects when bcdedit or bootcfg is executed and Safeboot registry keys modified within a specified time window
Detects the deletion of Volume Shadow Copies using native Windows utilities like WMIC or PowerShell cmdlets (Get-WmiObject, Get-CimInstance) targeting Win32_ShadowCopy. This behavior is a common indicator of ransomware preparation to inhibit system recovery prior to encryption, as observed in attacks involving the Akira ransomware.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
Detects suspicious activity associated with the AdaptixC2 framework, specifically process hollowing or shellcode injection where WmiPrvSE.exe spawns or creates remote threads in WAB.exe (Windows Address Book). This pattern has been observed in Akira ransomware intrusions.
Detects Akira ransomware-associated PowerShell script execution that attempts to terminate backup, virtualization, and database services (such as VMware, Veeam, Hyper-V, and MSSQL) and inhibit system recovery by deleting Volume Shadow Copies or disabling boot recovery features.
Page 1 of 3