Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
9
2
2
1
Contributors
3
3
3
2
2
Categories
6
6
5
2
2
Platforms
10
4
3
2
2
Products / Services
4
2
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects the mass creation of potential ransomware note files (e.g., decrypt.txt, recover.hta) across different directories on a single host. The rule correlates this file creation activity with the execution of common viewers (notepad.exe, mshta.exe, wordpad.exe) using the note file in the command line, while specifically excluding scenarios where standard file encryption activity is concurrent.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Identifies the creation of ransom notes or markers containing the victim ID bracket format used by Makop.
Detects attempts to overwrite web server content files for defacement
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects web defacement attempts via HTTP PUT requests to web server content files
This rule detects HTTP PUT requests to a web server where the URI path ends with common web file extensions such as .html, .htm, .php, .asp, or .aspx. This behavior is suspicious as it could indicate an attempt at web defacement (T1491) by an attacker trying to modify web content directly on the server.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
The following analytic detects the modification of registry keys related to the desktop wallpaper settings. It leverages Sysmon EventCode 13 to identify changes to the "Control Panel\\Desktop\\Wallpaper" and "Control Panel\\Desktop\\WallpaperStyle" registry keys, especially when the modifying process is not explorer.exe or involves suspicious file paths like temp or public directories. This activity is significant as it can indicate ransomware behavior, such as the REVIL ransomware, which changes the wallpaper to display a ransom note. If confirmed malicious, this could signify a compromised machine and the presence of ransomware, leading to potential data encryption and extortion.
The analytic identifies modifications to the TranscodedWallpaper file in the wallpaper theme directory, excluding changes made by explorer.exe. This detection leverages the Endpoint.Processes and Endpoint.Filesystem data models to correlate process activity with file modifications. This activity is significant as it may indicate an adversary attempting to deface or change the desktop wallpaper of a targeted host, a tactic often used to signal compromise or deliver a message. If confirmed malicious, this could be a sign of unauthorized access and tampering, potentially leading to further system compromise or data exfiltration.
This YARA rule detects the Albabat ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for patterns related to file encryption, dropping a ransom note, changing the desktop wallpaper, and finding files to encrypt. The presence of these combined patterns indicates the likely presence of the Albabat ransomware.
Yara rule that detects TaRRaK ransomware.