Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects the VILE ransomware payload attempting to display a ransom note by executing notepad.exe to open a specific file named 'HowToRestoreFiles.txt' from the 'C:\temp\' directory. This activity is indicative of the post-encryption phase of a ransomware attack.
Detects a high volume of files being renamed to the .mkp extension within a 5-minute window, indicative of rapid Makop ransomware encryption.
Detects the use of esxcli or vim-cmd commands on VMware ESXi hosts to power off virtual machines, remove software components (VIBs), or enable maintenance mode. These actions are commonly performed by the Akira ransomware group to disrupt operations and facilitate encryption.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
Detects the execution of known ransomware-related executables ('servertool.exe', 'encrypt.exe') when their command line arguments indicate interaction with cloud storage services such as OneDrive, SharePoint, GoogleDrive, Dropbox, or iCloud. This behavior is indicative of ransomware attempting to encrypt or exfiltrate data from cloud environments.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects unauthorized file writes to specific Google Chrome extension directories associated with the VILE ransomware. The rule monitors for file creation or modification events targeting known extension paths or files with the .vile extension suffix, indicating potential persistence or malicious extension installation.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
This rule detects two indicators associated with ransomware activity: the modification of the 'legalnoticetext' registry value, which is often used to display ransom notes on the Windows login screen, and the execution of Notepad to open a file named 'HowToRestoreFiles.txt', a common indicator of a ransom note left by ransomware operators.
Detects execution of the Prinz Eugen ransomware 'servertool.exe' accompanied by high-volume file modifications targeting files with the '.prinzeugen' extension. This behavior is indicative of the ransomware's file encryption process, specifically its file system traversal and modification-time sorting strategy used to prioritize recently modified files for encryption.
Detects the creation of a specific ransom note file associated with ShinyHunters activity within PeopleSoft web or application server configuration directories.
This rule detects the creation of a specific named mutex associated with the GreenBlood ransomware encryptor. The mutex name typically starts with 'Global\\GREENBLOOD_ENCRYPTOR_MUTEX_'. The presence of this mutex indicates potential GreenBlood ransomware activity on the system.
Detects GreenBlood ransomware activity by monitoring for the creation of its specific ransom note file ('READ_ME_TO_RECOVER_FILES.txt') and the renaming of files to its characteristic encrypted extensions ('.tgbg' or '.bak'). The rule aggregates these events by device and process, triggering an alert if a ransom note is dropped or if more than 5 files are renamed with the ransomware's extensions.
Correlates the deployment of the specific Nightspire ransom note (Nightspire_Readme.txt) across multiple directories during the encryption phase, identifying instances where more than 10 such files are created within a minute by the same process on a device.
This rule identifies potential ransomware activity by detecting a process performing a high volume of file rename or modification operations within a short time window. It specifically targets files with known ransomware extensions or those using randomized 6-8 character alphanumeric extensions, while excluding common administrative, backup, and temporary file operations performed by trusted software.
Detects high-volume file renaming activity where the new file extensions correspond to common ransomware patterns (e.g., .locked, .encrypted, .wncry). The rule excludes processes signed by reputable vendors to reduce noise.
Page 16 of 50