Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
This query detects PowerShell-based AES encryption activity followed by mass file rename/encryption indicators and ransom note creation within a correlated pre-defined timestamp.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects TOKYOCORE ransomware artifacts referencing the fsociety.exe binary being dropped to Downloads and copied to System32, alongside the WindowsUpdate.exe persistence copy
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects TOKYOCORE ransomware via high-confidence identity strings; a single match is sufficient
This rule detects potential ransomware activity by monitoring for specific PowerShell commands associated with file encryption (AES, CreateEncryptor, TransformFinalBlock) and suspicious file manipulation patterns, such as mass renaming of files with common ransomware extensions or the dropping of known ransom note filenames.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Tier 5 catch-all: flags files exhibiting a broad spread of TOKYOCORE-related strings across identity, C2, ransom-note/branding, destructive, file-operation, data-theft, and persistence clusters, regardless of which specific cluster dominates
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects files containing 3+ TOKYOCORE ransom note strings combined with 2+ C2-related strings (Tier 2 cluster overlap)
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Page 7 of 50