Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
Detects the creation of files commonly used as ransom notes (e.g., 'readme_locker' or 'readme_locker.txt') within common user directories such as the Desktop. This behavior is a strong indicator of a ransomware attack post-encryption.
Detects the presence of specific file extensions (.p2k, .3396bw_p2k) often associated with ransomware activity, as well as the creation of 'HowToRestoreFiles.txt' which is a common indicator of a ransom note file.
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
This rule detects the use of password derivation functions (like argon2id, scrypt, pbkdf2) in command lines, which can be indicative of ransomware activity, specifically associated with Prinz Eugen. It focuses on processes like 'servertool.exe', 'encrypt.exe', and 'powershell.exe' initiating these commands.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule identifies the MeshCentral agent by process image name and common deployment paths or by its execution via common shell/download utilities. It also looks for the creation of the ransom note file 'README-IF-YOU-SEE-THIS-YOU-VE-BEEN-HACKED.TXT'.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects high-volume file renaming activity where the new file extensions correspond to common ransomware patterns (e.g., .locked, .encrypted, .wncry). The rule excludes processes signed by reputable vendors to reduce noise.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects the deletion of volume shadow copies via vssadmin or wmic, removal of the Windows backup catalog using wbadmin, and the disabling of system recovery boot settings via bcdedit. This activity is consistent with pre-encryption preparation behavior observed in Akira ransomware attacks.
Detects coordinated activity characteristic of Akira ransomware, involving the inhibition of system recovery mechanisms (shadow copy deletion, backup catalog deletion, recovery policy modification) followed by high-volume file renaming (indicative of file encryption) across multiple host systems within a short timeframe.
Detects the high-tempo Medusa ransomware encryption phase by identifying a large number of file renaming operations that append the '.medusa' extension within a short timeframe (1 minute). This rule specifically looks for more than 50 such rename events per device per minute.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Detects execution of the Prinz Eugen Go-based ransomware binary (servertool.exe) with the --delete flag, which instructs the encryptor to remove original plaintext files after encryption. The binary is known to execute from user-writable paths such as Music and OneDrive directories.
Detects the activity of the Prinz Eugen ransomware, specifically tracking the execution of 'servertool.exe' as it creates temporary files with the '.prinzeugen.tmp' extension and subsequently renames them to finalize file encryption.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Page 14 of 50