Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects a burst of file modifications producing common
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns.
This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
Detects file system activity indicative of Royal and BlackSuit ransomware, specifically monitoring for the creation of ransom notes like 'README.TXT' or 'README.BlackSuit.txt' and mass renaming/encryption of files using extensions associated with these families (.royal, .royal_u, .blacksuit).
Detects VMware ESXi shell activity associated with the ShinySp1d3r encryptor. This includes the termination of VM processes via esxcli or vim-cmd, the deletion of VM snapshots, and suspicious file renaming or encryption activity on datastores consistent with ransomware behaviors.
Detects activity associated with Everest ransomware by matching known file hashes (in DeviceFileEvents/DeviceProcessEvents) and known C2/leak-site domains (in DeviceNetworkEvents).
Detects activity associated with Everest ransomware by matching known file hashes (in DeviceFileEvents/DeviceProcessEvents) and known C2/leak-site domains (in DeviceNetworkEvents).
Detects potential ransomware activity characterized by the mass renaming of files with specific extensions (.locked, .locked_wip) or the creation of known ransomware note filenames (RESTORE_FILES.txt) on a Windows system.
Detects the execution of files ending in '_win64.exe' from 'Perflogs' or 'Documents' directories, which is a known behavior of the Settra ransomware. The rule filters out common system and program file paths to reduce noise.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Page 1 of 50