Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
14
11
8
6
4
Contributors
23
8
5
2
2
Categories
29
13
7
7
6
Platforms
43
6
1
Products / Services
17
16
6
6
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
4
1
1
IDS Protocols
4
1
Detects potential SSH reverse tunneling or SOCKS proxying, often used by threat actors like Akira or associated with Bumblebee loaders, to establish persistent C2 channels. The rule monitors process execution of plink.exe and ssh.exe with suspicious arguments (e.g., -R, -D, -N), network connections to known malicious C2 IP addresses, and SSH tunnel processes running as SYSTEM or spawned by non-interactive service-related processes.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
Detects the use of the PostgreSQL client utility (psql.exe) to query the 'VeeamBackup' database, a technique observed in Akira ransomware intrusions to extract sensitive credentials directly from the backup server's configuration.
Detects the execution of wbadmin.exe to initiate a backup that specifically targets the NTDS.dit database and registry hives (SYSTEM, SECURITY), then stages them to a path on C:\ProgramData. This pattern is characteristic of credential dumping activities associated with the Akira ransomware, enabling offline extraction of domain credentials.
Detects the use of PowerShell to spawn 'net.exe' for the purpose of creating new domain accounts, modifying existing account properties, or escalating privileges by adding users to high-privilege groups such as Enterprise Admins. This activity is consistent with known Akira ransomware intrusion patterns, specifically aimed at establishing persistence or escalating privileges within a domain environment.
This rule detects potential Akira ransomware activity by correlating three distinct malicious phases on a network: first, the deletion of volume shadow copies using vssadmin, wmic, or powershell; second, the disabling of system recovery features via bcdedit or wbadmin; and third, high-volume file renaming (indicating encryption) across multiple endpoints. The rule aggregates these events to identify coordinated campaign activity across at least two hosts.
Detects unauthorized access to the Active Directory database (NTDS.dit) or registry hives (SYSTEM, SECURITY) using native Windows utilities like wbadmin.exe and ntdsutil.exe. This activity is indicative of credential dumping and staging efforts for exfiltration, as observed in Akira ransomware campaigns.
Detects reconnaissance activity associated with Akira ransomware, including PowerShell-based share enumeration (Invoke-ShareFinder, Get-NetShare), execution of unauthorized network scanning tools (e.g., SoftPerfect NetScan from non-standard paths), and the use of 'net view /domain' commands to identify accessible network resources.
Detects potential lateral movement by the Akira ransomware group. The rule triggers when a Windows interactive RDP logon (LogonType 10, NTLM V2) occurs on a target host while the source host simultaneously exhibits process execution of the 'AdgNsy.exe' file, which is a known agent associated with Akira's command-and-control infrastructure.
Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.
Detects Akira ransomware-related activity by identifying the creation of characteristic ransom notes or files with the .akira extension, combined with signs of security defense impairment (such as disabling Windows Defender via command line).
Detects a burst of commands consistent with Akira ransomware's recovery inhibition phase, where multiple system recovery features are disabled or deleted (e.g., Volume Shadow Copies, Windows Backup Catalog, Boot Recovery) within a 5-minute window on the same endpoint.
Detects indicators of Akira ransomware activity, including execution of the binary, dropping of ransom notes, renaming of files with .akira extension, and the use of vssadmin to delete volume shadow copies.
Detects Akira ransomware deployment by monitoring the execution of suspected binary files (n.exe or locker.exe) from the C:\ProgramData directory, correlated with system recovery inhibition commands (e.g., vssadmin, wmic, bcdedit) executed on the same host within a 2-hour timeframe.
Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Detects a sudden spike in Windows RestartManager Event ID 10000. A proliferation of RestartManager events is a strong indicator of active file encryption by ransomware (like INC or Akira) attempting to kill processes that are locking target files.
Detects DLL side-loading attacks where consent.exe loads known malicious
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
This rule detects the execution of WinSCP from any directory other than its standard installation path, 'C:\Program Files (x86)\WinSCP\'. This behavior can indicate the use of a portable version of WinSCP, which might be employed by adversaries for data exfiltration or other malicious activities to avoid detection by standard software inventory or whitelisting solutions. The rule specifically looks for process creation events where the image name ends with 'WinSCP.exe' or the original filename is 'winscp.exe', and then filters out executions originating from the legitimate installation directory.
Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.
Detects logon events (successful or failed) originating from workstations with suspicious or generic names, which can be an indicator of threat actor activity. This pattern has been associated with Akira ransomware campaigns.
Page 2 of 3