Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
246 detections
Filters
Last updated
All Time
Detection languages
143
77
16
5
3
Contributors
140
36
26
11
5
Categories
194
131
43
33
23
Platforms
232
5
4
3
1
Products / Services
60
9
7
5
4
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects the execution of the Warlock ransomware payload using rundll32.exe to call the specific 'RunCryptor' export function from 'run.dll'. This activity represents the final stage of the attack chain, immediately preceding enterprise-wide file encryption.
Detects the installation of the "Hotta Killer" tool, a Bring-Your-Own-Vulnerable-Driver (BYOVD) process killer used by the Interlock ransomware group to terminate security software. This is identified by the creation of a specific kernel driver file (`UpdateCheckerX64.sys`) and a corresponding Windows service with a distinct naming pattern (`UpdateCheckerX64_{random-numbers}`).
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Detects techniques used by the INC Ransomware Group, including the execution of their RainINC payload from C:\PerfLogs and the abuse of a renamed Restic binary for data exfiltration.
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Detects a process exhibiting multiple behaviors associated with Warlock ransomware. This rule correlates the termination of critical services, deletion of volume shadow copies within a short time window.
This rule detects the presence of Agenda Ransomware based on specific strings found within the file. These strings include references to 'Qilin' (a known alias for Agenda Ransomware), ransom notes detailing encrypted files and financial information, threats regarding law enforcement, and indicators of the ransomware being written in Rust ('rust', 'cargo'). It also looks for API calls 'Sleep' and 'SleepEx' which can be used for evasion, and an .onion address for communication.
This rule detects elements commonly found in 3AM ransomware notes. It looks for the strings "threeam" or "3 am", a specific onion URL pattern associated with 3AM ransomware (e.g., http://threeam[0-9,a-z]*.onion or http://3am[0-9,a-z]*.onion), and at least one of the keywords "encrypted", "data", or "payment". The combination of these indicators suggests the presence of a 3AM ransomware note, likely indicating a ransomware infection or an attempt to communicate ransom demands.
The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside in specific system directories, and deviations may indicate malicious activity. If confirmed malicious, this could allow an attacker to execute code at the kernel level, potentially leading to privilege escalation, persistence, or further system compromise.
This rule detects the Warlock ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include code responsible for encrypting files, killing processes, stopping services, and discovering drives, which are common behaviors of ransomware.
KQL Query
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
Detects a suspicious command-line pattern often used by ransomware, where the 'ping' command is used with a delay (e.g., '-n 3') to introduce a pause, immediately followed by the 'del' command with force and quiet flags ('-f -q') to delete a file. This technique is typically employed to hide the initial infection vector or other malicious files by deleting them after execution.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag, where the script is located in a potentially suspicious directory such as temporary folders or user application data directories. This behavior is often associated with defense evasion and system recovery inhibition by adversaries.
This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.
Detects Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with the Pay2Key ransomware campaign as reported by Morphisec in mid-2025. This includes specific file hashes, defense evasion techniques like adding Defender exclusions, sandbox evasion, and specific file artifacts.
KQL Query from file: DEVMAN ransomware detection
KQL Query from file: Detecting External Microsoft Teams Spray
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
Page 3 of 12