Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
124 detections
Filters
Last updated
All Time
Detection languages
75
40
7
1
1
Contributors
75
18
15
4
4
Categories
102
67
14
11
10
Platforms
118
3
2
1
1
Products / Services
33
4
3
2
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
Detects specific Windows registry modifications made by BlackByte ransomware variants. BlackByte sets three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption. This rule triggers when any of the specified registry keys are set to DWORD 1.
The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside in specific system directories, and deviations may indicate malicious activity. If confirmed malicious, this could allow an attacker to execute code at the kernel level, potentially leading to privilege escalation, persistence, or further system compromise.
This rule detects the Warlock ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include code responsible for encrypting files, killing processes, stopping services, and discovering drives, which are common behaviors of ransomware.
KQL Query
Detects a suspicious command-line pattern often used by ransomware, where the 'ping' command is used with a delay (e.g., '-n 3') to introduce a pause, immediately followed by the 'del' command with force and quiet flags ('-f -q') to delete a file. This technique is typically employed to hide the initial infection vector or other malicious files by deleting them after execution.
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag, where the script is located in a potentially suspicious directory such as temporary folders or user application data directories. This behavior is often associated with defense evasion and system recovery inhibition by adversaries.
This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.
KQL Query from file: DEVMAN ransomware detection
KQL Query from file: Detecting External Microsoft Teams Spray
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
KQL Query
KQL Query
This rule detects modifications to specific Windows Registry keys that are known to be used by BlackByte ransomware for privilege escalation and to prepare for lateral movement and encryption. Specifically, it looks for the setting of 'LocalAccountTokenFilterPolicy', 'EnableLinkedConnections', and 'LongPathsEnabled' to a DWORD value of '1'. These modifications can enable administrative shares for non-administrator accounts, allow for longer file paths, and potentially facilitate ransomware operations.
Find use of Alternate Data Streams (ADS) for anti-forensic purposes.
Alternate Data Streams execution.
Alternate Data Streams execution.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
Identify accounts that have logged on to affected endpoints.
Check for specific alerts.
Check for specific alerts.
Sticky Keys
KQL
A technique used in numerous ransomware attacks is a Sticky Keys hijack for privilege escalation/persistence. Surface realted alerts with this query.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
Page 2 of 6