Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
24
2
Contributors
26
Categories
22
8
4
4
1
Platforms
26
2
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
3
2
2
1
1
Detects browser session-cookie database access followed by session reuse under impossible-travel or concurrent-session conditions, consistent with Gunra's VDI session-hijacking technique.
Detects cmd.exe /c spawned by an unusual parent process combined with native-API execution patterns outside normal application behavior, excluding common benign parent-child chains, and requires co-occurrence with at least one other flagged detection before surfacing given its low specificity.
Detects Gunra ransomware components (main.exe, cryptor.exe, msmp.exe) via known file hashes, or via a clustered combination of embedded exclusion-logic strings referencing C:\Windows and .exe/.dll/.sys extensions used by the ChaCha20+RSA-4096 encryptor to skip system files; requires all exclusion strings present, in the expected order, and tightly clustered together to avoid matching unrelated installers that merely reference these common substrings individually
Detects unauthorized modification of VDI/authentication-portal files implementing a hard-coded OTP-acceptance bypass, a specific Gunra MFA-tampering technique distinguished from routine MFA policy changes.
Detects binaries importing both IsDebuggerPresent and CheckRemoteDebuggerPresent combined with anti-debug timing-check code patterns (rdtsc instruction and/or GetTickCount/QueryPerformanceCounter timing APIs), requiring multiple corroborating indicators to reduce false positives on legitimate software. Excludes binaries carrying a verified digital signature to avoid flagging legitimately signed software using these APIs for license-protection or anti-tamper purposes.
Page 2 of 2