Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects a high volume of file rename operations where files are appended with a randomized 16-character hexadecimal extension. This is a characteristic behavior of LockBit 5.0 ransomware during its encryption phase.
This rule detects the Warlock ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include code responsible for encrypting files, killing processes, stopping services, and discovering drives, which are common behaviors of ransomware.
This rule detects suspicious activities related to Protected Process Light (PPL) and driver loading that could indicate privilege escalation, defense evasion, or impact. Specifically, it looks for:
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
1. Processes running with 'System' integrity that were initiated by a process with a lower integrity level, which could suggest an attempt to elevate privileges.
2. Driver image load events where 'ntoskrnl.exe' is the initiating process, but the driver is loaded from a location outside of the standard 'System32' or 'System32\drivers' directories. This could indicate an adversary attempting to load malicious drivers to evade detection or persist.
3. DriverLoad actions initiated by 'ntoskrnl.exe' from outside the standard 'System32' or 'System32\drivers' directories, similar to the image load events, pointing to potential malicious driver activity.
Yara rule that detects Warlock ransomware.
Detects activity related to the PromptLock ransomware, which leverages the Ollama AI API and is written in Go. This rule looks for network connections to the Ollama service (port 11434) and related process executions, specifically identifying processes like go.exe, curl.exe, wget.exe, python.exe, powershell.exe making connections or processes with 'ollama' in their command line.
Detects scenarios where an attacker enable or reconfigure BitLocker on multiple hosts for ransomware purposes.
Detects scenarios where an attacker configures BitLocker for ransomware purposes.
This detection identifies the presence of PromptLock ransomware by looking for known malicious file hashes (SHA1 and SHA256). PromptLock is reported to be the first AI-powered ransomware, written in Go, and uses a local AI model to generate malicious Lua scripts. The rule searches across both file and process creation events for wider coverage.
Detects the execution of "taskkill.exe" with the /f (force) flag, which is used to forcefully terminate processes. This activity can be leveraged by attackers for data destruction or data encryption for impact, particularly against services like Exchange and SQL Server. The rule includes filters to reduce false positives from common installer behaviors.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects and logs file creation events triggered by the FunkLocker ransomware executable across all monitored systems, enabling early identification of malicious activity and facilitating rapid incident response.
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
Detects AK47/X2ANYLOCK ransomware, a tool used by the CL-CRI-1040 threat actor. The rule identifies the malware based on unique PDB paths and embedded ransom note artifacts.
This rule detects suspicious PowerShell command patterns associated with the Chaos ransomware group. These commands are used for environment setup, preparing for large file downloads, and remote command execution.
Detects indicators and behaviors related to the Chaos ransomware group including command-line patterns, suspicious registry changes, and specific known IOCs.
Detects the Chaos ransomware encryptor based on unique command-line arguments and embedded strings.
Detects modifications to Group Policy Objects (GPOs) that enable script processing. Threat actors, such as Storm-2603, abuse GPOs to deploy ransomware (like Warlock) by adding malicious startup or logon scripts. This detection identifies when the "Group Policy Scripts" client-side extension is added to a GPO, which is a key step in this attack chain. This activity is logged under Event ID 5136 on Domain Controllers.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
Detects a wide range of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with SafePay ransomware, including specific command lines, persistence mechanisms, defense evasion techniques, and host-based artifacts.
Detects Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with the Pay2Key ransomware campaign as reported by Morphisec in mid-2025. This includes specific file hashes, defense evasion techniques like adding Defender exclusions, sandbox evasion, and specific file artifacts.
KQL Query from file: DEVMAN ransomware detection
Page 27 of 50