Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
The rule detects the creation of a specific mutex name: 'abcdefghijklmnoklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890'. This mutex name is associated with ROADSWEEP ransomware activity. The detection is based on monitoring process creation events in Windows environments for the presence of this exact mutex name.
This rule detects the presence of specific mutex names associated with WannaCry ransomware activity. The rule looks for processes creating or interacting with mutexes named 'MsWinZonesCacheCounterMutexA' or 'Global\MsWinZonesCacheCounterMutexW'. These mutexes are known indicators of WannaCry infection.
The rule detects the creation of specific mutex names associated with VanHelsing ransomware. It looks for the mutex 'Global\VanHelsing'.
This rule detects the creation of specific mutex names associated with Suncrypt ransomware. The detection is based on a direct match of known, unique mutex strings, indicating the presence or activity of Suncrypt ransomware on a Windows system.
This rule detects the creation of specific mutexes known to be associated with Ryuk ransomware activity. The rule specifically looks for a mutex named 'rykmutex'. The presence of this mutex indicates a high probability of Ryuk ransomware execution on the system.
The rule detects the creation of specific mutex names associated with Money Message ransomware. It looks for the mutex '12345-12345-12235-12354' during process creation events on Windows systems. The presence of this mutex indicates potential Money Message ransomware activity.
The rule detects the creation of specific mutexes known to be associated with Mamona ransomware. It looks for the mutex name 'Global\Fxo16jmdgujs437' during process creation events on Windows systems. The presence of this mutex indicates potential Mamona ransomware activity.
This rule detects the creation of specific mutex names associated with DragonForce ransomware. The detection is triggered when a process creates a mutex named 'dragonforce_encrypted_system'. This activity is indicative of the DragonForce ransomware encrypting a system, as mutexes are often used by malware to ensure only one instance is running or to signal certain operational states.
This rule detects the creation of specific mutex names associated with the 'Underground' ransomware. The detection is based on a direct match of the mutex name '8DC1F7B9D2F4EA58'. The rule is designed to identify activity related to this particular ransomware variant.
This rule detects the creation of specific mutex names associated with TeslaCrypt ransomware activity. The detection is based on a static list of known mutex strings: '8765-123rvr4', '2134-1234-1324-2134-1324-2134', 'System1230123', 'dslhufdks3', and '9_9_9_9'. The rule triggers when any of these mutex names are observed, indicating potential TeslaCrypt infection or execution.
This rule detects the creation of specific mutexes known to be associated with RAWorld ransomware activity. The rule specifically looks for the mutex name 'For whom the bell tolls, it tolls for thee'. Detection of this mutex indicates a high probability of RAWorld ransomware execution on the system.
The rule detects the creation of specific mutexes associated with the NailaoLocker ransomware. It looks for the mutex name 'Global\lockv7'. This activity is indicative of the NailaoLocker ransomware executing on a system.
The rule detects the presence of specific mutex names associated with the HelloXD ransomware. It looks for the mutex 'With best wishes And good intentions...' during process creation events on Windows systems. This indicates potential HelloXD ransomware activity, which typically encrypts files and demands a ransom, aligning with the impact tactic T1486 (Data Encrypted for Impact).
This rule detects the creation of a mutex named 'EKANS'. This mutex name is known to be associated with the EKANS ransomware. The detection is based on monitoring process creation events in Windows environments for the presence of this specific mutex name.
The rule detects the creation of specific mutex names associated with Crytox ransomware. It looks for mutexes starting with 'itkd' or 'CSWS' followed by four characters that are generated based on the target Process ID (PID). This detection is based on known indicators of Crytox ransomware activity.
This rule detects the creation of specific mutex names ('BooYYoYnYoooY') that are known to be associated with Pay2Key ransomware activity. The detection is based on monitoring process creation events in Windows environments.
This rule detects the creation of specific mutexes ('ThisisMutexa' or 'FFFFFMutex') that are known to be associated with Pandora ransomware activity. The detection is based on monitoring process creation events for these mutex names.
The rule detects the creation of specific mutex names associated with Karma ransomware activity. It specifically looks for a mutex named 'KARMA'. This detection is based on the presence of these mutexes, which are known indicators of Karma ransomware execution.
The rule detects the creation of specific mutexes known to be associated with Embargo ransomware activity. It specifically looks for mutexes named 'LoadUpOnGunsBringYourFriends' or 'IntoTheFloodAgainSameOldTrip' during process creation events on Windows systems.
This rule detects the creation of specific mutexes known to be associated with DJVU ransomware activity. The rule looks for the exact mutex names '{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}' or '{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}'. The detection is based on process creation events on Windows systems where these mutex names are observed.
Detects the creation of specific mutexes known to be associated with the CHARON ransomware. The rule looks for the mutex name 'OopsCharonHere'.
Page 22 of 50