Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
246 detections
Filters
Last updated
All Time
Detection languages
143
77
16
5
3
Contributors
140
36
26
11
5
Categories
194
131
43
33
23
Platforms
232
5
4
3
1
Products / Services
60
9
7
5
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects potential exploitation attempts against SonicWall SMA1000 appliances, specifically targeting the /wsproxy endpoint using a custom 'SMA Connect Agent' user agent string. This behavior is associated with SSRF vulnerabilities (CVE-2026-15409 and CVE-2026-15410) identified as being utilized by the threat actor group UTA0533 in campaigns involving INC Ransomware.
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
Detects high-volume file modification events resulting in files renamed with the .inc extension, which is a characteristic behavior of the INC ransomware strain. The rule monitors for more than 50 such modifications on a single host within a 10-minute window, serving as an indicator of active encryption and potential ransomware impact.
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
Detects Reynolds ransomware terminating hardcoded EDR/AV process names via its NSecKrnl kernel driver. The rule identifies process terminations of known security software executables and correlates it with the presence of the '402.sys' driver in the 'C:\ProgramData' folder, which is associated with the NSecKrnl driver used by Reynolds ransomware.
Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.
Detects the presence of debugger context strings indicative of Makop's loader exception triggering, specifically looking for '.cxr ' or 'dump context' in the process command line. This behavior is often associated with anti-analysis techniques used by malware like Makop Ransomware to detect and evade debugging environments.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
Detects the creation and subsequent deletion or modification of 'wipefile.tmp' or similarly named temporary wipe artifacts, which are used by the Gentlemen ransomware during its cleanup phase. This rule specifically looks for file events (creation, deletion, modification) related to this filename.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects network connections to remote URLs containing specific keywords ('festung', 'germania', 'deutsch', 'prinz', 'eugen') that are indicative of Germany-themed infrastructure potentially associated with the Prinz Eugen Ransomware. This helps identify early communication with command and control servers or data exfiltration points.
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
Detects wallpaper registry modifications using .bmp files, indicative of a ransom note being set by an unusual process. The rule specifically looks for changes to the 'Wallpaper' value or any key containing '\Control Panel\Desktop' in the registry, where the new wallpaper file ends with '.bmp'. It excludes modifications made by common system processes like 'explorer.exe', 'svchost.exe', and 'systemsettings.exe' to reduce false positives.
Correlates suspicious Temp directory creation with immediate wallpaper registry modifications, a common pattern for Makop ransom notes.
Detects the execution of a 64-character hex-named executable using the 'i=' parameter for potential process injection or tracking, indicative of Makop Ransomware activity.
Identifies the creation of ransom notes or markers containing the victim ID bracket format used by Makop.
This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
Page 1 of 12