Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects files with hashes reported as the ransomware payload in the incident report.
Detects known mutexes associated with Payload ransomware activity.
Detects a high volume of file renaming operations to the '.ENCRT' extension, combined with the creation of the 'R3ADM3.txt' ransom note by the same process. This behavior is characteristic of the Gunra ransomware encryption routine.
Detects the creation of files with a 64-character hexadecimal filename followed by a '.keystore' extension. This is a unique artifact of the Gunra ransomware's 'separate keystore' mode used for storing encryption keys.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
The rule detects the creation of specific mutexes associated with the Beast ransomware. It looks for mutex names 'BEAST HERE?'. This activity is indicative of the Beast ransomware executing on a Windows system, likely as part of its encryption or operational phases.
The rule detects the creation of specific mutexes ('tech') that are known to be associated with Hermes ransomware activity. This detection is based on monitoring process creation events for these mutex names.
This rule detects the creation of a specific mutex named 'DoYouWantToHaveSexWithCuongDong'. This mutex name is known to be associated with Babuk ransomware activity. The detection is based on monitoring process creation events on Windows systems for the presence of this particular mutex.
The rule detects the presence of specific mutex names ('PAYDAYDAYPAY') that are known to be associated with BTCWare ransomware activity. This detection is based on process creation events where these mutexes are observed.
The rule detects the creation of specific mutexes known to be associated with Scarabey ransomware. The detection is triggered when a process creates a mutex with the name 'STOPSCARABSTOPSCARABSTOPSCARABSTOPSCARABSTOPSCARAB'.
Detects known mutexes associated with DireWolf ransomware activity. Specifically, it looks for the mutex named 'Global\direwolfAppMutex'.
The rule detects the creation of specific mutex names ('m23071644') associated with Makop ransomware activity. It monitors process creation events on Windows systems for these mutexes, indicating potential ransomware infection or execution.
The rule detects the creation of specific mutexes known to be associated with the Gunra ransomware. It looks for the mutex name 'kjsidugiaadf99439' during process creation events on Windows systems. The presence of this mutex indicates potential Gunra ransomware activity, which typically involves encrypting files and demanding a ransom, falling under the impact category of data encryption.
This rule detects the creation of specific mutexes associated with the DarkAngels ransomware. The detection is based on the presence of the mutex name 'DarkAngels'. The rule aims to identify potential DarkAngels ransomware activity on Windows systems by monitoring process creation events for these mutexes.
This rule detects the creation of specific mutex names associated with Zola ransomware activity. The detection is based on the presence of the mutex '4B991369-7C7C-47AA-A81E-EF6ED1F5E24C'. The rule monitors process creation events on Windows systems to identify these mutexes, which are indicators of Zola ransomware execution or presence.
The rule detects the creation of specific mutexes associated with ZCryptor ransomware activity. It specifically looks for a mutex named 'zcrypt1.0'. The detection is based on process creation logs from Windows systems.
The rule detects the creation of specific mutex names associated with Nitrogen ransomware activity. It specifically looks for the mutex 'nvxkjcv7yxctvgsdfjhv6esdvsx'. This indicates the presence or execution of the Nitrogen ransomware on a Windows system.
The rule detects the creation of a specific mutex named 'dawdhahdaw'. This mutex name is associated with d0glun ransomware activity. The detection is based on monitoring process creation events on Windows systems.
This rule detects the creation of specific mutexes known to be associated with Cl0p ransomware activity. The detection is based on a predefined list of unique mutex names that Cl0p ransomware has been observed to use. The rule triggers when any of these mutex names are identified during process creation events on Windows systems.
Detects the creation of a process that utilizes the mutex name 'FAUST'. This specific mutex name is associated with AiLock ransomware activity, indicating a potential infection or execution of this malware.
The rule detects the creation of a specific mutex named 'Global\VohukMutex'. This mutex name is associated with Vohuk ransomware activity, indicating a potential infection or execution of this malware.
Page 21 of 50