Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
Detects a miner or renamed executable running from a suspicious directory structure within ProgramData with mining command-line characteristics.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects a miner or renamed executable running from a hidden-looking ProgramData directory with mining command-line characteristics. This often indicates cryptojacking activity where an attacker is using system resources for cryptocurrency mining without authorization.
Detects exploitation of application vulnerabilities for denial of service
This rule monitors for the execution of Windows utilities (vssadmin, wmic, diskshadow, wbadmin, bcdedit) with command-line arguments associated with deleting shadow copies or disabling system recovery features. This behavior is commonly observed in ransomware attacks to prevent system restoration.
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects file modifications containing specific threat actor emails associated with a Makop ransomware variant. This rule looks for file rename or creation events where the filename contains 'stephanielkfujo@web.de' or 'stephanielklfujo@web.de'.
Detects deletion of MFA configurations to enable authentication bypass
Detects connections to cryptocurrency mining pools
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
Correlates the creation of the RESTORE_FILES.txt or GENTLEMEN_README.txt ransom note in multiple directories across the file system, specifically when more than 5 notes are created within a minute by the same process on a device.
Detects a mining process launched with a stratum endpoint, wallet address, worker name, or GPU algorithm arguments. This rule identifies common cryptocurrency mining software (xmrig, lolminer, phoenixminer, nbminer, minerd, miner) when executed with command-line parameters indicative of connecting to a mining pool or specifying wallet/algorithm details.
Detects a script or small watchdog process repeatedly launching the same miner on one device within a short period. This behavior is indicative of cryptojacking activity where a persistent mechanism ensures the cryptocurrency miner continues to run even if terminated.
Page 70 of 149