Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
246 detections
Filters
Last updated
All Time
Detection languages
143
77
16
5
3
Contributors
140
36
26
11
5
Categories
194
131
43
33
23
Platforms
232
5
4
3
1
Products / Services
60
9
7
5
4
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
KQL Query
Instead of running several queries separately, you can also use a comprehensive query that checks for multiple signs of ransomware activity to identify affected devices. The following consolidated query:
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Looks for both relatively concrete and subtle signs of ransomware activity
Weighs the presence of these signs
Identifies devices with a higher chance of being targets of ransomware
When run, this consolidated query returns a list of devices that have exhibited multiple signs of attack. The count of each type of ransomware activity is also shown.
Prior to deploying Macaw ransomware in an organization, the adversary will disable all controlled folders, which will enable them to be encrypted once the ransomware payload is deployed.
Find use of Alternate Data Streams (ADS) for anti-forensic purposes.
Alternate Data Streams execution.
Alternate Data Streams execution.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
Identify accounts that have logged on to affected endpoints.
Check for specific alerts.
Check for specific alerts.
This rule detects when the ASR rule AsrRansomwareBlocked or AsrRansomwareAudited is triggered.
No alert is generated by default. This could be the start of a ransomware attack.
Additional information available by Microsoft:
https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#use-advanced-protection-against-ransomware
No alert is generated by default. This could be the start of a ransomware attack.
Additional information available by Microsoft:
https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#use-advanced-protection-against-ransomware
Sticky Keys
KQL
A technique used in numerous ransomware attacks is a Sticky Keys hijack for privilege escalation/persistence. Surface realted alerts with this query.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
This query surfaces alerts related to Gootkit and enriches with command and control information, which has been observed delivering ransomware.
This query identifies use of wmic.exe to delete shadow copy snapshots prior to encryption.
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
Use this query to locate persistence in Startup with HTA files.
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
Fake Replies
KQL
Use this query to find spoofed reply emails that contain certain keywords in the subject. The emails are also checked for a link to a document in Google Docs.
These attacks have been observed leading to ransomware
These attacks have been observed leading to ransomware
This query checks for attempts to clear at least 10 log entries from event logs using wevtutil.
Use this query to look for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns
Prior to deploying Macaw ransomware in an organization, adversaries will change the password for hundreds or thousands of accounts in order to lock users out of the network and impeded recovery efforts.
Page 4 of 12