Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects the creation of common ransomware note file names with suspicious extensions.
Detects the creation of multiple ransom notes (HTML, TXT, or HTA files with specific keywords) across several distinct directories, indicative of MedusaLocker ransomware activity.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects the execution of cmd.exe triggered by specific potentially malicious filenames or involving known ransomware-related artifacts, such as 'boottel.dat', ransomware note files, or specific suspicious file extensions like '.SZO'. This is indicative of ransomware deployment or post-compromise cleanup and extortion activities.
Correlates the final execution of a dropped ransomware binary directly from the C:\ProgramData\JWrapper or related SimpleHelp cache directories, identified by common ransomware flags in the process command line.
Detects the high-velocity renaming of files across user directories to append the .gentlemen extension, indicative of ransomware activity.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
This rule detects a suspicious sequence of events indicative of ransomware activity, specifically the Prinz Eugen ransomware. It looks for the execution of common file compression utilities (7z.exe, rar.exe, WinRAR.exe, winzip.exe) followed by the execution of known ransomware encryption executables (servertool.exe, encrypt.exe) on the same device within a 30-minute window. This pattern suggests that an attacker is compressing files before encrypting them, a common tactic to reduce the size of data for faster encryption or exfiltration.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
Detects file modifications containing specific threat actor emails associated with a Makop ransomware variant. This rule looks for file rename or creation events where the filename contains 'stephanielkfujo@web.de' or 'stephanielklfujo@web.de'.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
Page 17 of 50