Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects execution of the Prinz Eugen Go-based ransomware binary (servertool.exe) with the --delete flag, which instructs the encryptor to remove original plaintext files after encryption. The binary is known to execute from user-writable paths such as Music and OneDrive directories.
Detects the activity of the Prinz Eugen ransomware, specifically tracking the execution of 'servertool.exe' as it creates temporary files with the '.prinzeugen.tmp' extension and subsequently renames them to finalize file encryption.
Detects a sequence of events where an actor deletes a Google Cloud Storage bucket and then immediately recreates it, a pattern consistent with bucket hijacking intended to manipulate resource access or bypass security controls on data streams.
Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects the use of vssadmin.exe or wmic.exe to delete Volume Shadow Copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects the creation or modification of Azure Storage Account management policies that include rules configured to delete blobs, snapshots, or versions in less than 30 days. This behavior may indicate an attempt at data destruction or unauthorized cleanup of cloud storage objects.
Detects attempts to delete Volume Shadow Copies (VSS) using 'vssadmin' or 'wmic' commands, especially when these commands are executed by unusual parent processes. This activity is a common tactic used by ransomware, such as Qilin, to prevent system recovery.
Detects the execution of a Go binary named 'servertool.exe' or any executable containing 'servertool' in its command line, when combined with suspicious command-line arguments indicative of file deletion or directory traversal, while excluding common system directories like 'Program Files' and 'Windows'. This rule aims to identify activity associated with the Prinz Eugen ransomware.
Shadow Delete Activity
YARA-L
Detects attempts to delete shadow copies or disable system recovery using common administrative tools.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Detects wallpaper registry modifications using .bmp files, indicative of a ransom note being set by an unusual process. The rule specifically looks for changes to the 'Wallpaper' value or any key containing '\Control Panel\Desktop' in the registry, where the new wallpaper file ends with '.bmp'. It excludes modifications made by common system processes like 'explorer.exe', 'svchost.exe', and 'systemsettings.exe' to reduce false positives.
Detects attempts to delete backup catalogs or shadow copies using wbadmin.exe or vssadmin.exe, common anti-recovery techniques used by Makop ransomware.
This rule detects activities aimed at inhibiting system recovery by identifying attempts to delete volume shadow copies via vssadmin, wmic, or powershell, in combination with disabling windows recovery mode using bcdedit. This behavior is indicative of ransomware preparation, where an adversary attempts to prevent the restoration of data before encryption.
Detects a spoofed utility executable (like CrystalDiskInfo via MSI) loading the malicious autorun.dll from the downloads path, indicative of a cryptojacking campaign.
Detects rapid sequential file rename/write operations across multiple directories within a short window, which is a behavioral signature of active ransomware encryption activity. The rule specifically looks for more than 200 file operations (renamed or created) with a file extension matching a 4-8 character alphanumeric pattern, across more than 5 unique folders, all occurring within a 2-minute window and completing within 120 seconds.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Page 64 of 149