Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects known mutexes associated with Cerber ransomware activity. The rule specifically looks for mutex names matching 'SHELL.{<uuid>}'.
The rule detects the creation of specific mutexes associated with BqtLock ransomware activity. It looks for the mutex name 'Global\{00A0B0C0-D0E0-F000-1000-200030004000\}' during process creation events on Windows systems.
This rule detects the creation of a specific mutex name, 'Global\EA408C6BF0D12F526F821798C3F54C9A', which is known to be associated with Bluesky ransomware activity. The detection is based on monitoring process creation events for the presence of this unique mutex identifier.
The rule detects the creation of specific mutexes known to be associated with BlackMatter ransomware. It specifically looks for a mutex named '0d216858b68c0bcae655c2eaffeee2ad'. The detection is based on process creation events where this mutex name is observed.
This rule detects the creation of specific mutexes associated with BlackHunt ransomware activity. The rule triggers if a process creates a mutex named 'BlackKeys' or 'BLACK_HUNT_MUTEX'. These mutex names are known indicators of BlackHunt ransomware, suggesting an active infection or an attempt to prevent multiple instances of the ransomware from running simultaneously. The detection relies on monitoring process creation events for these specific mutex names.
The rule detects the creation of specific mutexes associated with Big Head ransomware activity. It looks for processes creating mutexes named '8bikfjjD4JpkkAqrz' or 'v6PdkcEldmq3vfupE'. This detection is based on the `process_creation` log category on Windows systems, specifically monitoring for these known ransomware-related mutex names.
This rule detects the creation of specific mutexes known to be associated with AvosLocker ransomware activity. The detection logic looks for processes creating mutexes named 'ievah8eVki3Ho4oo' or 'Cheic0WaZie6zeiy'. The presence of these mutexes indicates a high probability of AvosLocker ransomware execution on a Windows system.
This rule detects the creation of processes that utilize specific mutex names associated with Avaddon ransomware. The detection is based on the presence of the mutex '{2A0E9C7B-6BE8-4306-9F73-1057003F605B}' during process creation events. This indicates potential Avaddon ransomware activity on the system.
The rule detects the creation of specific mutexes known to be associated with the Anatova ransomware. It looks for a process creating a mutex with the exact name '6a8c9937zFIwHPZ309UZMZYVnwScPB2pR2MEx5SY7B1xgbruoO'. This activity is indicative of Anatova ransomware execution or presence on a Windows system.
The rule detects the creation of specific mutexes associated with the 5ss5c ransomware. It looks for the mutex name '5ss5c_CRYPT' during process creation events on Windows systems. The presence of this mutex indicates potential 5ss5c ransomware activity.
The rule detects the creation of specific mutexes ('OurMainMutex999' or 'OurMainMutex999net') which are known to be associated with Matrix ransomware activity. This detection focuses on identifying the presence of these unique mutex names as an indicator of compromise by Matrix ransomware.
This rule detects the creation of specific mutexes (89A72EF01) that are known to be associated with Mallox ransomware activity. The presence of these mutexes indicates a high probability of Mallox ransomware execution on a Windows system.
The rule detects the creation of a process that utilizes a mutex named 'wolf'. This specific mutex name is associated with Lorenz ransomware activity. The detection is based on monitoring process creation events and checking for the presence of this particular mutex name.
The rule detects the creation of specific mutex names associated with Kraken ransomware. It looks for mutexes named 'Microsoft-Kraken-<ComputerName>'. The detection logic is based on the 'process_creation' log source category on Windows systems, specifically monitoring the 'MutexName' field.
Identifies processes that first communicate with AI services and then perform a low-volume burst of file creation or deletion events. This behavioral pattern may indicate an AI-driven ransomware or wiper attack that is surgically targeting key data to evade traditional volume-based detection methods, as theorized by Check Point Research.
Detects the creation of a directory junction pointing to a OneDrive synchronization folder. This is a key component of the 'DoubleDrive' technique, used to force the synchronization of arbitrary local files for data exfiltration or cloud-based ransomware encryption.
The query aim to identify a typical ransomware behavior which is file encryption follow by file deletion
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
This rule detects the specific artifacts associated with the '01flip' ransomware. It triggers when a ransom note named 'RECOVER-YOUR-FILE.TXT' is created, followed by the rapid renaming of more than 10 files on the same host with the '.01flip' extension. The correlation is based on the hostname and the process command line within a 5-minute window, indicating a coordinated ransomware attack.
Detects techniques used by the INC Ransomware Group, including the execution of their RainINC payload from C:\PerfLogs and the abuse of a renamed Restic binary for data exfiltration.
Detects ransom note creation associated with Yurei ransomware.
Page 25 of 50