Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
The rule detects the creation of specific mutex names associated with BlackSuit ransomware activity. It specifically looks for the mutex 'Global\WLm87eV1oNRx6P3E4Cy9'. The detection is based on process creation events in Windows environments.
The rule detects the creation of specific mutexes known to be associated with BlackStore ransomware. Specifically, it looks for a mutex named 'Global\FSWiper'. The presence of this mutex indicates potential BlackStore ransomware activity on a Windows system.
Detects the creation of specific mutexes ('Global\BlackMutex') known to be associated with BlackBerserk ransomware activity. The rule specifically looks for these mutex names, indicating a high confidence in identifying this particular ransomware.
This rule detects the creation of specific mutexes known to be associated with Black Basta ransomware. The rule looks for process creation events where the MutexName field matches either 'dsajdhas.0' or 'ofijweiuhuewhcsaxs.mutex'. The detection is based on unique mutex names identified in Black Basta ransomware activity, making false positives unlikely for these specific strings.
The rule detects the creation of specific mutexes associated with AstraLocker ransomware. It specifically looks for a mutex named 'EncryptedWithAstraLocker'. The detection logic is based on the 'process_creation' log category on Windows systems, focusing on the 'MutexName' field. This indicates an attempt to identify the presence or activity of AstraLocker ransomware by monitoring for its known mutex identifiers.
This rule detects the creation of specific mutexes associated with Trinity ransomware. The detection is based on the `MutexName` field containing the string '48065934119990121'. The rule is designed to identify Trinity ransomware activity by monitoring for these unique mutexes.
This rule detects the creation of specific mutexes associated with Tisak ransomware. The rule specifically looks for a mutex named 'Global\TisakMutex'. The presence of this mutex indicates potential Tisak ransomware activity on the system.
This rule detects the creation of a process that utilizes a mutex named 'TaRRaK'. This specific mutex name is associated with the TaRRaK ransomware, indicating potential ransomware activity on the system.
The rule detects the creation of specific mutexes associated with Surtr ransomware. It looks for a mutex named 'SurtrMUTEX'. The detection is based on process creation events on Windows systems.
The rule detects the creation of specific mutexes associated with StarCat ransomware. It looks for a mutex named 'start_cat_encrypt'. The presence of this mutex indicates potential StarCat ransomware activity on a Windows system.
The rule detects the creation of specific mutexes associated with Satan ransomware activity. It looks for mutex names 'SSSS_Scan' or 'SATAN_CRYPT'. The detection is based on process creation events on Windows systems.
Detects known mutexes associated with Rook ransomware activity. The rule specifically looks for the mutex name 'asfgjkl878645165456fa888' during process creation events on Windows systems.
This rule detects the creation of specific mutexes associated with Risen ransomware. It looks for the mutex name 'risen_mutex' during process creation events on Windows systems. The presence of these mutexes indicates potential Risen ransomware activity, which typically involves encrypting files and demanding a ransom.
This rule detects the creation of a mutex named 'RedeemerMutex'. This mutex is known to be associated with Redeemer ransomware activity. The detection is based on monitoring process creation events for specific mutex names.
The rule detects the creation of a mutex named 'Pysa'. This specific mutex name is associated with PYSA ransomware activity. The detection is based on monitoring process creation events on Windows systems and looking for the presence of this mutex name. The primary goal is to identify potential PYSA ransomware infections by detecting a known indicator of compromise.
The rule detects the creation of specific mutex names ('hoJUpcvgHA') that are known to be associated with PrincessLocker ransomware activity. This detection is based on monitoring process creation events for these particular mutexes.
This rule detects the creation of specific mutexes known to be associated with Phobos ransomware activity. The rule looks for two distinct mutex names: 'Global\u003c\u003cBID\u003e\u003e300AF62D00000001' and 'Global\u003c\u003cBID\u003e\u003eC4BA364700000001'. The presence of either of these mutexes indicates potential Phobos ransomware infection or execution on a Windows system.
The rule detects the creation of specific mutexes associated with Noblis ransomware activity. It looks for a mutex named 'mutex_rr_windows'.
The rule detects the creation of specific mutexes ('hate' or 'just_a_game') that are known to be associated with Nemty ransomware activity. This detection is based on monitoring process creation events for these particular mutex names.
The rule detects the creation of specific mutexes known to be associated with Nefilim ransomware activity. It looks for two distinct mutex names: 'ONA MOYA ROZA I YA EE LUBLUUUUUUUU, ONA MOYA DOZA - SEGODNYA ZATYANU' and 'Den'gi plyvut v karmany rekoy. My khodim po krayu nozha...'. The detection is triggered when a process creates a mutex with either of these names.
The rule detects the creation of specific mutex names associated with Moisha ransomware activity. It looks for the mutex 'Global\__w3616de3-6u4b-32fc-97b1-de928faadf50'. This detection is based on the presence of these unique mutex strings, which are indicators of the ransomware's execution.
Page 23 of 50