Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the creation of specific mutex names that are known to be associated with GuptiMiner activity. The mutex names include patterns like 'Mutex_ONLY_ME_V<version>', 'SLDV<2-3 numeric>', 'GlobalMIVOD_V4', 'MIVOD_6', and 'MTX_EX01'. Detection of these mutexes indicates the presence or execution of the GuptiMiner malware on a Windows system, which is known for cryptocurrency mining and backdoor capabilities.
The rule detects the creation of specific mutexes known to be associated with Embargo ransomware activity. It specifically looks for mutexes named 'LoadUpOnGunsBringYourFriends' or 'IntoTheFloodAgainSameOldTrip' during process creation events on Windows systems.
This rule detects the creation of specific mutexes associated with the Dustman wiper malware. The mutex name 'Down With Bin Salman' is a strong indicator of this particular wiper's activity. Detection of this mutex suggests that the Dustman wiper may be active on the system, potentially leading to data destruction.
This rule detects the creation of specific mutexes known to be associated with DJVU ransomware activity. The rule looks for the exact mutex names '{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}' or '{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}'. The detection is based on process creation events on Windows systems where these mutex names are observed.
Detects the creation of specific mutexes known to be associated with the CHARON ransomware. The rule looks for the mutex name 'OopsCharonHere'.
The rule detects the creation of specific mutex names associated with BlackSuit ransomware activity. It specifically looks for the mutex 'Global\WLm87eV1oNRx6P3E4Cy9'. The detection is based on process creation events in Windows environments.
The rule detects the creation of specific mutexes known to be associated with BlackStore ransomware. Specifically, it looks for a mutex named 'Global\FSWiper'. The presence of this mutex indicates potential BlackStore ransomware activity on a Windows system.
Detects the creation of specific mutexes ('Global\BlackMutex') known to be associated with BlackBerserk ransomware activity. The rule specifically looks for these mutex names, indicating a high confidence in identifying this particular ransomware.
This rule detects the creation of specific mutexes known to be associated with Black Basta ransomware. The rule looks for process creation events where the MutexName field matches either 'dsajdhas.0' or 'ofijweiuhuewhcsaxs.mutex'. The detection is based on unique mutex names identified in Black Basta ransomware activity, making false positives unlikely for these specific strings.
This rule detects the creation of specific mutexes known to be associated with the Azov wiper malware. The mutex names 'Local\Kasimir_C', 'Local\Kasimir_E', and 'Local\azov' are monitored. The detection is based on process creation events on Windows systems where these mutex names are observed.
The rule detects the creation of specific mutexes associated with AstraLocker ransomware. It specifically looks for a mutex named 'EncryptedWithAstraLocker'. The detection logic is based on the 'process_creation' log category on Windows systems, focusing on the 'MutexName' field. This indicates an attempt to identify the presence or activity of AstraLocker ransomware by monitoring for its known mutex identifiers.
This rule detects the creation of specific mutexes associated with Trinity ransomware. The detection is based on the `MutexName` field containing the string '48065934119990121'. The rule is designed to identify Trinity ransomware activity by monitoring for these unique mutexes.
This rule detects the creation of specific mutexes associated with Tisak ransomware. The rule specifically looks for a mutex named 'Global\TisakMutex'. The presence of this mutex indicates potential Tisak ransomware activity on the system.
This rule detects the creation of a process that utilizes a mutex named 'TaRRaK'. This specific mutex name is associated with the TaRRaK ransomware, indicating potential ransomware activity on the system.
The rule detects the creation of specific mutexes associated with Surtr ransomware. It looks for a mutex named 'SurtrMUTEX'. The detection is based on process creation events on Windows systems.
The rule detects the creation of specific mutexes associated with StarCat ransomware. It looks for a mutex named 'start_cat_encrypt'. The presence of this mutex indicates potential StarCat ransomware activity on a Windows system.
The rule detects the creation of specific mutexes associated with Satan ransomware activity. It looks for mutex names 'SSSS_Scan' or 'SATAN_CRYPT'. The detection is based on process creation events on Windows systems.
Detects known mutexes associated with Rook ransomware activity. The rule specifically looks for the mutex name 'asfgjkl878645165456fa888' during process creation events on Windows systems.
This rule detects the creation of specific mutexes associated with Risen ransomware. It looks for the mutex name 'risen_mutex' during process creation events on Windows systems. The presence of these mutexes indicates potential Risen ransomware activity, which typically involves encrypting files and demanding a ransom.
This rule detects the creation of a mutex named 'RedeemerMutex'. This mutex is known to be associated with Redeemer ransomware activity. The detection is based on monitoring process creation events for specific mutex names.
The rule detects the creation of a mutex named 'Pysa'. This specific mutex name is associated with PYSA ransomware activity. The detection is based on monitoring process creation events on Windows systems and looking for the presence of this mutex name. The primary goal is to identify potential PYSA ransomware infections by detecting a known indicator of compromise.
Page 89 of 149