Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the creation of specific mutexes associated with CryptoLuck ransomware. The rule specifically looks for a mutex named 'CryptoLuck_Instance'. The presence of this mutex indicates potential CryptoLuck ransomware activity on a Windows system.
The rule detects the creation of specific mutex names ('Catawba!') which are known to be associated with CryptoFortress ransomware activity. This detection is based on monitoring process creation events on Windows systems and checking for the presence of these particular mutex names.
This rule detects the creation of specific mutexes known to be associated with Crypt0r ransomware. The detection is based on the presence of the mutex name 'crypt0r-mutex'. The rule leverages process creation logs to identify these mutexes, indicating potential Crypt0r ransomware activity on a Windows system.
This rule detects the creation of specific mutexes known to be associated with Conti ransomware activity. The rule looks for the exact mutex names 'kjsidugidf99439' or 'hsfjuukjzloqu28oajh727190'. Detection of these mutexes indicates a high probability of Conti ransomware execution on a Windows system.
The rule detects the creation of a specific mutex named 'Global\ContactoMutex'. This mutex is known to be associated with the Contacto ransomware. The detection is based on monitoring process creation events on Windows systems for the presence of this particular mutex name. The primary goal is to identify potential Contacto ransomware activity by detecting this unique identifier used by the malware.
The rule detects the creation of processes that utilize specific mutex names associated with CoinHelper miner activity. Specifically, it looks for the mutex name 'QPRZ<digit>bWvXh'. The detection is based on the 'process_creation' log category on Windows systems.
This rule detects the creation of specific mutexes associated with the ChiChi ransomware. The detection is based on the presence of the mutex name 'chichigotmanagedyou'. The rule leverages process creation logs from Windows systems to identify these mutexes, indicating potential ChiChi ransomware activity. False positives are considered unlikely due to the unique nature of the mutex name.
Detects known mutexes associated with Cerber ransomware activity. The rule specifically looks for mutex names matching 'SHELL.{<uuid>}'.
The rule detects the creation of specific mutexes associated with BqtLock ransomware activity. It looks for the mutex name 'Global\{00A0B0C0-D0E0-F000-1000-200030004000\}' during process creation events on Windows systems.
This rule detects the creation of a specific mutex name, 'Global\EA408C6BF0D12F526F821798C3F54C9A', which is known to be associated with Bluesky ransomware activity. The detection is based on monitoring process creation events for the presence of this unique mutex identifier.
The rule detects the creation of specific mutexes known to be associated with BlackMatter ransomware. It specifically looks for a mutex named '0d216858b68c0bcae655c2eaffeee2ad'. The detection is based on process creation events where this mutex name is observed.
This rule detects the creation of specific mutexes associated with BlackHunt ransomware activity. The rule triggers if a process creates a mutex named 'BlackKeys' or 'BLACK_HUNT_MUTEX'. These mutex names are known indicators of BlackHunt ransomware, suggesting an active infection or an attempt to prevent multiple instances of the ransomware from running simultaneously. The detection relies on monitoring process creation events for these specific mutex names.
The rule detects the creation of specific mutexes associated with Big Head ransomware activity. It looks for processes creating mutexes named '8bikfjjD4JpkkAqrz' or 'v6PdkcEldmq3vfupE'. This detection is based on the `process_creation` log category on Windows systems, specifically monitoring for these known ransomware-related mutex names.
This rule detects the creation of specific mutexes known to be associated with AvosLocker ransomware activity. The detection logic looks for processes creating mutexes named 'ievah8eVki3Ho4oo' or 'Cheic0WaZie6zeiy'. The presence of these mutexes indicates a high probability of AvosLocker ransomware execution on a Windows system.
This rule detects the creation of processes that utilize specific mutex names associated with Avaddon ransomware. The detection is based on the presence of the mutex '{2A0E9C7B-6BE8-4306-9F73-1057003F605B}' during process creation events. This indicates potential Avaddon ransomware activity on the system.
The rule detects the creation of specific mutexes known to be associated with the Anatova ransomware. It looks for a process creating a mutex with the exact name '6a8c9937zFIwHPZ309UZMZYVnwScPB2pR2MEx5SY7B1xgbruoO'. This activity is indicative of Anatova ransomware execution or presence on a Windows system.
The rule detects the creation of specific mutexes associated with the 5ss5c ransomware. It looks for the mutex name '5ss5c_CRYPT' during process creation events on Windows systems. The presence of this mutex indicates potential 5ss5c ransomware activity.
The rule detects the creation of specific mutexes ('OurMainMutex999' or 'OurMainMutex999net') which are known to be associated with Matrix ransomware activity. This detection focuses on identifying the presence of these unique mutex names as an indicator of compromise by Matrix ransomware.
This rule detects the creation of specific mutexes (89A72EF01) that are known to be associated with Mallox ransomware activity. The presence of these mutexes indicates a high probability of Mallox ransomware execution on a Windows system.
The rule detects the creation of a process that utilizes a mutex named 'wolf'. This specific mutex name is associated with Lorenz ransomware activity. The detection is based on monitoring process creation events and checking for the presence of this particular mutex name.
The rule detects the creation of specific mutex names associated with Kraken ransomware. It looks for mutexes named 'Microsoft-Kraken-<ComputerName>'. The detection logic is based on the 'process_creation' log source category on Windows systems, specifically monitoring the 'MutexName' field.
Page 91 of 149