Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
45 detections
Filters
Last updated
All Time
Detection languages
14
13
12
4
2
Contributors
12
11
9
5
2
Categories
18
10
8
5
4
Platforms
40
5
4
2
1
Products / Services
16
6
4
3
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
LockBit C2Beacon
YARA
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
Detects the java.exe (ActiveMQ) process spawning cmd.exe to run certutil for payload delivery. This is highly indicative of CVE-2023-46604 post-exploitation activity, leading to Metasploit and LockBit ransomware deployment.
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
Detects a Java process starting certutil to download a file from the internet. This is unusual for a message broker and can indicate a server has been taken over and is pulling down a payload.
Detects files with hashes reported as the ransomware payload in the incident report.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
Detects a Java process starting cmd or PowerShell. On an ActiveMQ server this can indicate that someone is running commands after exploiting the service.
This rule detects suspicious Spring bean XML content, specifically looking for indicators related to the exploitation of Apache ActiveMQ CVE-2023-46604. It targets XML payloads that attempt to execute commands using 'ProcessBuilder' and download files via 'certutil -urlcache' from an HTTP source, consistent with observed attack patterns.
The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
This analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
Page 1 of 3