Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This rule detects the creation of specific mutexes known to be associated with MedusaLocker ransomware. The detection is based on the presence of the mutex name '8761ABBD-7F85-42EE-B272-A76179687C63'. The rule is designed to identify MedusaLocker activity by monitoring for these unique mutex identifiers.
This rule detects the creation of specific mutexes known to be associated with Koxic ransomware. The detection is based on the presence of the mutex name '_atus_'. The primary goal is to identify Koxic ransomware activity on Windows systems.
The rule detects the creation of specific mutexes ('SAY_HI_2025') that are known to be associated with KawaLocker ransomware activity. This detection is based on monitoring process creation events for these particular mutex names.
This rule detects the creation of specific mutexes known to be associated with Indrik ransomware activity. The detection specifically looks for a mutex named 'Global\Indrik'. The presence of this mutex indicates potential Indrik ransomware infection or execution on a Windows system.
This rule detects the creation of specific mutexes known to be associated with Hydra ransomware activity. The detection logic specifically looks for the mutex name 'Local\$hYdr4Rans$'. This indicates a high-confidence detection of Hydra ransomware execution or presence on a Windows system.
This rule detects the creation of specific mutexes associated with HelloKitty ransomware. The detection is triggered when a process creates a mutex named 'HELLOKITTYMutex'. This activity is indicative of HelloKitty ransomware execution or presence on a system.
Detects the creation of specific mutexes ('HamsterLiveHere') that are known to be associated with Hamster ransomware activity. This rule focuses on identifying the presence of these unique mutex names as an indicator of compromise by Hamster ransomware.
The rule detects the creation of specific mutexes associated with Gryphon ransomware. It specifically looks for a mutex named 'GIVEMEBTC'. The detection is based on monitoring process creation events in Windows environments.
This rule detects the creation of specific mutexes associated with the GarrantyDecrypt ransomware. The detection is based on the presence of the mutex name '666_nop_nop_nop_nop'. This activity is indicative of the GarrantyDecrypt ransomware executing on a system.
This rule detects the creation of specific mutexes known to be associated with GandCrab ransomware. The rule looks for two distinct mutex names: 'Global\pc_group=<Pc_Group>&ransom_id=<Victim_id>' and 'AversSucksForever'. The presence of either of these mutexes indicates potential GandCrab ransomware activity on a Windows system.
This rule detects the creation of specific mutexes associated with Fog ransomware activity. It looks for two distinct mutex names: '6jSf6QFH0VGR5XL4RGYarc5YVpB4W1H3' and 'BgGnsEdRrztEhEfg0vF8ZaFPYtoyg4lDQ'. The detection is based on process creation events in Windows environments where these mutex names are observed.
The rule detects the creation of specific mutexes known to be associated with Dharma ransomware activity. It specifically looks for a mutex named 'Global\syncronize_<uniqueid>', where '<uniqueid>' likely represents a variable or dynamically generated string.
The rule detects the creation of specific mutex names ('CheckMutex') that are known to be associated with Darkrace ransomware activity. This detection focuses on identifying a characteristic behavior of the Darkrace ransomware, which is the creation of these mutexes during its execution. The rule is triggered when a process creates a mutex with one of the specified names.
The rule detects the creation of specific mutex names ('Global\dbdbdbdb') that are known to be associated with DarkBit ransomware activity. This detection is based on monitoring process creation events for these particular mutexes.
This rule detects the creation of specific mutexes associated with Cylance ransomware activity. The detection is triggered when a process creates a mutex named 'CylanceMutex'. This indicates potential ransomware execution or preparation on a Windows system.
This rule detects the creation of specific mutexes associated with CryptoLuck ransomware. The rule specifically looks for a mutex named 'CryptoLuck_Instance'. The presence of this mutex indicates potential CryptoLuck ransomware activity on a Windows system.
The rule detects the creation of specific mutex names ('Catawba!') which are known to be associated with CryptoFortress ransomware activity. This detection is based on monitoring process creation events on Windows systems and checking for the presence of these particular mutex names.
This rule detects the creation of specific mutexes known to be associated with Crypt0r ransomware. The detection is based on the presence of the mutex name 'crypt0r-mutex'. The rule leverages process creation logs to identify these mutexes, indicating potential Crypt0r ransomware activity on a Windows system.
This rule detects the creation of specific mutexes known to be associated with Conti ransomware activity. The rule looks for the exact mutex names 'kjsidugidf99439' or 'hsfjuukjzloqu28oajh727190'. Detection of these mutexes indicates a high probability of Conti ransomware execution on a Windows system.
The rule detects the creation of a specific mutex named 'Global\ContactoMutex'. This mutex is known to be associated with the Contacto ransomware. The detection is based on monitoring process creation events on Windows systems for the presence of this particular mutex name. The primary goal is to identify potential Contacto ransomware activity by detecting this unique identifier used by the malware.
This rule detects the creation of specific mutexes associated with the ChiChi ransomware. The detection is based on the presence of the mutex name 'chichigotmanagedyou'. The rule leverages process creation logs from Windows systems to identify these mutexes, indicating potential ChiChi ransomware activity. False positives are considered unlikely due to the unique nature of the mutex name.
Page 24 of 50