Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects attempts to delete Volume Shadow Copies (VSS) using 'vssadmin' or 'wmic' commands, especially when these commands are executed by unusual parent processes. This activity is a common tactic used by ransomware, such as Qilin, to prevent system recovery.
Detects the execution of a Go binary named 'servertool.exe' or any executable containing 'servertool' in its command line, when combined with suspicious command-line arguments indicative of file deletion or directory traversal, while excluding common system directories like 'Program Files' and 'Windows'. This rule aims to identify activity associated with the Prinz Eugen ransomware.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Detects rapid sequential file rename/write operations across multiple directories within a short window, which is a behavioral signature of active ransomware encryption activity. The rule specifically looks for more than 200 file operations (renamed or created) with a file extension matching a 4-8 character alphanumeric pattern, across more than 5 unique folders, all occurring within a 2-minute window and completing within 120 seconds.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by identifying rapid bulk file modifications or renames that result in files adopting extensions commonly associated with ransomware encryption. It looks for a high volume of file events (creation, modification, rename) within a short timeframe (1 hour) where the new file extensions match a predefined list of ransomware-specific extensions.
Detects the widespread creation of the specific !readme_medusa!.txt ransom note or its HTML variant across directories, indicating a Medusa ransomware operation.
Detects the use of icacls.exe and takeown.exe to recursively modify file permissions, specifically targeting broad filesystem paths or system-critical binaries. This behavior is indicative of ransomware preparing for encryption by taking ownership and modifying ACLs to ensure access to protected files.
Detects the modification of the 'LegalNoticeText' registry value to display Pay2Key ransomware-related strings. This activity is indicative of a system being targeted or compromised by the Pay2Key ransomware, which uses this registry key to display a ransom message upon user logon.
Detects the execution of notepad.exe where the command line arguments reference a file named 'HowToRestoreFiles.txt'. This behavior is characteristic of ransomware variants that launch Notepad to display instructions to victims after file encryption has occurred.
Detects activity associated with VILE ransomware where it modifies files within the Chrome extension locale directory (specifically for the extension nmmhkkegccagdldgiimedpiccmgmieda) by appending the .vile extension, indicating potential file encryption or tampering for impact.
Detects the Pay2Key ransomware displaying a ransom note by spawning notepad.exe to open a file named 'HowToRestoreFiles.txt' located in the 'C:\temp\' directory, typically as a result of execution from registry persistence keys.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Detects modifications to the Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System where the 'legalnoticetext' value is set to contain 'pay2key'. This technique is used by the Pay2Key ransomware to display a ransom note as a system-wide legal notice during user logon.
Detects behavior indicative of Pay2Key ransomware, specifically the renaming of files with a '.3396bw_p2k' extension, the creation of 'HowToRestoreFiles.txt' ransom notes by Everything.exe, or file rename activity initiated by Everything.exe from a 7Zip SFX temporary directory.
Detects activity associated with VILE ransomware where files within the Google Chrome extensions directory are renamed with the .vile extension, indicating an ongoing file encryption process by the malware.
Page 15 of 50