Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects activity associated with VILE ransomware where it modifies files within the Chrome extension locale directory (specifically for the extension nmmhkkegccagdldgiimedpiccmgmieda) by appending the .vile extension, indicating potential file encryption or tampering for impact.
Detects the Pay2Key ransomware displaying a ransom note by spawning notepad.exe to open a file named 'HowToRestoreFiles.txt' located in the 'C:\temp\' directory, typically as a result of execution from registry persistence keys.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Detects the execution of Windows native utilities wbadmin.exe to delete system backup catalogs and bcdedit.exe to disable boot recovery features. This combination of commands is a hallmark of Pay2Key ransomware, used to inhibit victim system recovery following encryption.
Detects modifications to the Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System where the 'legalnoticetext' value is set to contain 'pay2key'. This technique is used by the Pay2Key ransomware to display a ransom note as a system-wide legal notice during user logon.
Detects the specific behavior associated with the TrymeLocker malware DestroyCMD function, which involves stripping file permissions from cmd.exe using takeown and icacls, followed by the deletion or renaming of cmd.exe within the System32 or SysWOW64 directories to disable command execution.
Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.
Detects attempts to inhibit system recovery by identifying multiple, distinct commands aimed at deleting volume shadow copies, backup catalogs, or disabling boot recovery features (e.g., using vssadmin, wmic, bcdedit, or wbadmin) from the same parent process within a 60-second window, which is common behavior for ransomware strains like TrymeLocker.
Detects behavior indicative of Pay2Key ransomware, specifically the renaming of files with a '.3396bw_p2k' extension, the creation of 'HowToRestoreFiles.txt' ransom notes by Everything.exe, or file rename activity initiated by Everything.exe from a 7Zip SFX temporary directory.
Detects activity associated with VILE ransomware where files within the Google Chrome extensions directory are renamed with the .vile extension, indicating an ongoing file encryption process by the malware.
Detects the execution of Windows native utilities wbadmin and bcdedit configured to inhibit system recovery, a common behavior observed in ransomware campaigns to prevent data restoration. Specifically, it monitors for the deletion of the Windows Backup catalog and the modification of boot configuration to ignore failure states.
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects the VILE ransomware payload attempting to display a ransom note by executing notepad.exe to open a specific file named 'HowToRestoreFiles.txt' from the 'C:\temp\' directory. This activity is indicative of the post-encryption phase of a ransomware attack.
Detects LCRYX ransomware and similar malicious activity involving the deletion of volume shadow copies, backup catalogs, and the disabling of system recovery features using standard Windows administrative utilities such as vssadmin, wbadmin, wmic, and bcdedit.
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
Detects the execution of PowerShell or Command Prompt initiated by Windows script interpreters (wscript.exe, cscript.exe) that contain command-line arguments indicative of malicious activity. This includes commands related to raw disk access, system recovery inhibition (e.g., shadow copy or backup catalog deletion), and boot configuration manipulation often associated with ransomware or wiper activity.
Detects instances where VBScript or JScript engines (wscript.exe, cscript.exe) spawn PowerShell or BCDedit processes. The rule specifically monitors for activities related to disk tampering (e.g., physical drive access or File I/O) and the suppression of Windows recovery features via bcdedit, which are common tactics used by ransomware and destructive malware to disable system backups and prevent remediation.
Detects the execution of Windows system recovery manipulation commands (vssadmin, wbadmin, or bcdedit) initiated by script interpreters (wscript.exe, cscript.exe). This pattern is commonly observed in malware and ransomware campaigns attempting to prevent system recovery.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects the execution of Windows recovery-inhibiting commands (shadow copy deletion, backup catalog deletion, and boot recovery policy modification) originating from wscript.exe, a behavior commonly associated with the LCRYX ransomware family.
Identifies the creation of ransom notes or markers containing the victim ID bracket format used by Makop.
Page 66 of 149