Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects the execution of a potential file encryption utility that uses command-line flags ('enc'/'dec', '-k'/'-i'/'--keyfile') in conjunction with a 'key.txt' file. This pattern is characteristic of custom encryption tools used by threat actors to encrypt files on a system.
Detects execution of the GigaWiper 'WipeCMain' functionality, characterized by specific command line indicators associated with a multi-pass disk wiping process. This behavior is indicative of destructive wiper malware attempting to render data on system drives irrecoverable.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
Detects dropped builder/README/config files from underground Ransomware-as-a-Service kits bundling FUD AES-256 crypters, private stubs, decrypters, and key generators for Windows 10/11 ransomware payloads
This rule detects the presence of the GodDamn ransomware encryptor on a host by identifying the specific binary filename (encrypter-windows-gui-x86.exe), its known SHA256 hash, or the presence of the .God8Damn file extension commonly associated with files encrypted by this malware.
Detects the execution of the Windows shutdown utility with arguments to force an immediate system reboot. This behavior is commonly observed during the final stages of ransomware attacks, such as NoEscape, to force the system into a state where encrypted files are finalized or to disrupt user access.
Detects direct raw access to the primary physical disk device (PhysicalDrive0) on Windows systems. This behavior is often associated with ransomware or wiper malware attempting to overwrite the Master Boot Record (MBR) or partition table to render the system unbootable.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
Detects attempts to inhibit system recovery by deleting Volume Shadow Copies using native Windows utilities (vssadmin, wmic, diskshadow) or modifying boot configuration to disable recovery settings (bcdedit), as well as unauthorized modifications to the FilesNotToSnapshot registry key.
This rule detects attempts to directly access and modify raw disk devices, a technique commonly used by wiper malware like GigaWiper. It monitors for operations involving raw physical disk paths (e.g., \\.\PhysicalDrive) in conjunction with strings indicative of disk destructive routines such as partition removal, disk creation IOCTLs, or raw drive handle manipulation.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects recurring kernel panic or oops events on KVM hosts occurring in rapid succession, typically within a 5-minute window. This behavioral pattern is consistent with an attacker repeatedly exploiting a race condition, such as a use-after-free (UAF) in the KVM shadow MMU, to trigger a persistent host denial-of-service.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects mass file renaming activities involving the '.Liushen' extension, commonly associated with the LIUSHEN ransomware behavior where files are appended with this extension after being encrypted.
Detects the use of system utilities (net.exe, net1.exe, taskkill.exe, sc.exe) to stop five or more services identified as security, backup, or database software. This behavior is indicative of an adversary attempting to disable security monitoring and backup recovery tools, a common precursor to ransomware encryption.
Page 43 of 149