Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
The rule detects the creation of specific mutex names ('hoJUpcvgHA') that are known to be associated with PrincessLocker ransomware activity. This detection is based on monitoring process creation events for these particular mutexes.
This rule detects the creation of specific mutexes known to be associated with Phobos ransomware activity. The rule looks for two distinct mutex names: 'Global\u003c\u003cBID\u003e\u003e300AF62D00000001' and 'Global\u003c\u003cBID\u003e\u003eC4BA364700000001'. The presence of either of these mutexes indicates potential Phobos ransomware infection or execution on a Windows system.
The rule detects the creation of specific mutexes associated with Noblis ransomware activity. It looks for a mutex named 'mutex_rr_windows'.
The rule detects the creation of specific mutexes ('hate' or 'just_a_game') that are known to be associated with Nemty ransomware activity. This detection is based on monitoring process creation events for these particular mutex names.
The rule detects the creation of specific mutexes known to be associated with Nefilim ransomware activity. It looks for two distinct mutex names: 'ONA MOYA ROZA I YA EE LUBLUUUUUUUU, ONA MOYA DOZA - SEGODNYA ZATYANU' and 'Den'gi plyvut v karmany rekoy. My khodim po krayu nozha...'. The detection is triggered when a process creates a mutex with either of these names.
The rule detects the creation of specific mutex names associated with Moisha ransomware activity. It looks for the mutex 'Global\__w3616de3-6u4b-32fc-97b1-de928faadf50'. This detection is based on the presence of these unique mutex strings, which are indicators of the ransomware's execution.
This rule detects the creation of specific mutexes known to be associated with MedusaLocker ransomware. The detection is based on the presence of the mutex name '8761ABBD-7F85-42EE-B272-A76179687C63'. The rule is designed to identify MedusaLocker activity by monitoring for these unique mutex identifiers.
This rule detects the creation of specific mutexes known to be associated with Koxic ransomware. The detection is based on the presence of the mutex name '_atus_'. The primary goal is to identify Koxic ransomware activity on Windows systems.
The rule detects the creation of specific mutexes ('SAY_HI_2025') that are known to be associated with KawaLocker ransomware activity. This detection is based on monitoring process creation events for these particular mutex names.
This rule detects the creation of specific mutexes known to be associated with Indrik ransomware activity. The detection specifically looks for a mutex named 'Global\Indrik'. The presence of this mutex indicates potential Indrik ransomware infection or execution on a Windows system.
This rule detects the creation of specific mutexes known to be associated with Hydra ransomware activity. The detection logic specifically looks for the mutex name 'Local\$hYdr4Rans$'. This indicates a high-confidence detection of Hydra ransomware execution or presence on a Windows system.
This rule detects the creation of specific mutexes associated with HelloKitty ransomware. The detection is triggered when a process creates a mutex named 'HELLOKITTYMutex'. This activity is indicative of HelloKitty ransomware execution or presence on a system.
Detects the creation of specific mutexes ('HamsterLiveHere') that are known to be associated with Hamster ransomware activity. This rule focuses on identifying the presence of these unique mutex names as an indicator of compromise by Hamster ransomware.
The rule detects the creation of specific mutexes associated with Gryphon ransomware. It specifically looks for a mutex named 'GIVEMEBTC'. The detection is based on monitoring process creation events in Windows environments.
This rule detects the creation of specific mutexes associated with the GarrantyDecrypt ransomware. The detection is based on the presence of the mutex name '666_nop_nop_nop_nop'. This activity is indicative of the GarrantyDecrypt ransomware executing on a system.
This rule detects the creation of specific mutexes known to be associated with GandCrab ransomware. The rule looks for two distinct mutex names: 'Global\pc_group=<Pc_Group>&ransom_id=<Victim_id>' and 'AversSucksForever'. The presence of either of these mutexes indicates potential GandCrab ransomware activity on a Windows system.
This rule detects the creation of specific mutexes associated with Fog ransomware activity. It looks for two distinct mutex names: '6jSf6QFH0VGR5XL4RGYarc5YVpB4W1H3' and 'BgGnsEdRrztEhEfg0vF8ZaFPYtoyg4lDQ'. The detection is based on process creation events in Windows environments where these mutex names are observed.
The rule detects the creation of specific mutexes known to be associated with Dharma ransomware activity. It specifically looks for a mutex named 'Global\syncronize_<uniqueid>', where '<uniqueid>' likely represents a variable or dynamically generated string.
The rule detects the creation of specific mutex names ('CheckMutex') that are known to be associated with Darkrace ransomware activity. This detection focuses on identifying a characteristic behavior of the Darkrace ransomware, which is the creation of these mutexes during its execution. The rule is triggered when a process creates a mutex with one of the specified names.
The rule detects the creation of specific mutex names ('Global\dbdbdbdb') that are known to be associated with DarkBit ransomware activity. This detection is based on monitoring process creation events for these particular mutexes.
This rule detects the creation of specific mutexes associated with Cylance ransomware activity. The detection is triggered when a process creates a mutex named 'CylanceMutex'. This indicates potential ransomware execution or preparation on a Windows system.
Page 90 of 149