Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
41
34
25
13
13
Contributors
30
26
18
11
11
Categories
62
57
32
28
19
Platforms
39,920
7,245
6,529
3,864
3,627
150
Products / Services
28
14
13
11
11
MITRE Techniques
52
51
42
35
23
CVEs
4
2
1
1
1
IDS Classtypes
8
4
1
IDS Protocols
12
Detects the exploitation of the VMware vSphere Remote Code Execution vulnerability (CVE-2021-21972) by identifying HTTP POST requests to the '/ui/vropspluginui/rest/services/uploadova' endpoint. This specific URI indicates an attempt to upload a malicious OVA file, which is the vector for the RCE.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects GwisinLocker ransomware.
Page 8 of 8