Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
37 detections
Filters
Last updated
All Time
Detection languages
23
4
3
2
2
Contributors
8
7
7
5
4
Categories
11
10
8
6
6
Platforms
34
4
2
1
1
Products / Services
13
5
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
1
1
Detects the creation of ransom or extortion note files within known web server directories immediately following suspicious HTTP activity targeting an internet-facing host. This pattern aligns with known ShinyHunters extortion tactics where applications are exploited to deploy extortion notes.
Detects a multi-stage extortion tactic where a host is targeted by a mass creation of initial decryption-style ransom notes across multiple directories, followed by a subsequent drop of distinct follow-up 'press release' or 'threat' notes within a 30-minute window, indicative of INC Ransom behavior.
Detects the creation of ransom notes by the OpnKey ransomware family, which specifically uses the filename #Restore-My-Files.txt. This file is a characteristic indicator of the ransomware's post-encryption activity.
This rule detects unauthorized modification of the desktop wallpaper registry key to an empty string, typically used for desktop defacement or disruptive activity, followed by a system parameter refresh to apply the changes immediately. It monitors for the use of reg.exe to clear the wallpaper registry value and rundll32.exe to invoke the User32.dll UpdatePerUserSystemParameters function, which forces the Windows shell to refresh desktop settings.
Detects the execution of MCI commands via winmm.dll to play 'fsociety_sound.mp3', a technique used by TOKYOCORE ransomware to perform audio theatrics during its lockscreen phase.
Detects the creation of a specific wallpaper file ('image_danger.jpg') associated with the GigaWiper malware family, which is indicative of a system defacement attempt during the destructive phase of an attack.
Detects specific registry modifications indicative of the NoEscape ransomware, including changes to desktop wallpaper settings, auto-colorization preferences, and Explorer shell policies used to restrict user interaction or modify system aesthetics as part of an extortion campaign.
Detects the creation of a 'C:\user.png' file, which is known to be used as a marker file by NoEscape ransomware/wiper malware at the root of the system drive.
Detects modifications to the Windows Registry that disable the ability for a user to change their desktop wallpaper by setting the 'NoChangingWallPaper' value within the 'ActiveDesktop' policy key to '1'. This is often associated with system tampering to enforce restricted user environments.
Detects the execution of processes containing command line strings associated with the NoEscape ransomware lock screen. These messages are used to intimidate victims by displaying full-screen ransom demands.
Detects the creation of a specific wallpaper file ('image_danger.jpg') associated with the GigaWiper malware family, which is indicative of a system defacement attempt during the destructive phase of an attack.
Detects the creation of a specific wallpaper file ('image_danger.jpg') associated with the GigaWiper malware family, which is indicative of a system defacement attempt during the destructive phase of an attack.
Detects the creation of BMP files within the Temp directory containing the pattern 'wallpaper_', which is a behavior consistent with LIUSHEN ransomware modifying the desktop background to display a ransom note.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects anomalous file modifications to web-accessible directories (such as index.html, dist, public, or wwwroot) by common JavaScript execution environments including node.exe, bun.exe, or npm. This activity is consistent with post-compromise tampering of web assets as observed in the Miasma/Hades campaign, likely involving the abuse of stolen repository credentials to deploy malicious content.
Detects the creation of multiple ransom notes (HTML, TXT, or HTA files with specific keywords) across several distinct directories, indicative of MedusaLocker ransomware activity.
This rule detects attempts to modify web server files, specifically 'index.html' within a 'wwwroot' directory, over the Server Message Block (SMB) protocol. The detection is based on the presence of these strings in network traffic directed to port 445 (SMB) on the internal network. This activity could indicate an attacker attempting to deface a web server or inject malicious code.
This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects registry value settings that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Page 1 of 2