Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
363 detections
Filters
Last updated
All Time
Detection languages
167
84
32
27
19
Contributors
72
68
54
38
18
Categories
201
123
98
78
62
Platforms
215
118
97
39
7
Products / Services
76
69
48
32
25
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
2
1
IDS Classtypes
28
4
1
IDS Protocols
23
6
1
1
Detects the execution of Nmap or Zenmap, which are network scanning tools. Adversaries commonly use these tools for network service discovery to identify open ports and services on remote hosts, potentially looking for vulnerabilities to exploit.
lnx_susp_dev_tcp
Sigma
Detects suspicious command with /dev/tcp
Detects suspicious command with /dev/tcp
Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation
This rule detects the DarkSide ransomware by identifying specific byte patterns (YARA signatures) associated with its functionality. The rule looks for combinations of code that suggest file enumeration, drive enumeration, privilege escalation, and network share enumeration, which are common behaviors of DarkSide ransomware. Specifically, it checks for two main sets of conditions: one involving finding files, enumerating drives, and escalating privileges, and another involving finding files and enumerating network shares. The rule also verifies that the file is a Windows executable (MZ header).
Yara rule that detects Ransomexx ransomware.
Page 18 of 18