Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
This rule detects the creation of specific mutexes associated with Payload ransomware activity. The detection is triggered when a process creates a mutex named 'MakeAmericaGreatAgain'. This activity is indicative of the Payload ransomware attempting to ensure only one instance of itself is running on a system.
This rule detects the creation of processes that utilize specific mutex names associated with the Chrysalis backdoor. The detection is based on the presence of the mutex name 'Global\Jdhfv_1.0.1'. This activity is indicative of the Chrysalis backdoor operating on a system, likely for persistence or to ensure single instance execution.
The rule detects the creation of processes that utilize specific mutex names associated with the Rhadamanthys stealer. Specifically, it looks for the mutex name 'Global\MSCTF.Asm.{digits}', where '{digits}' represents a variable sequence of numbers. This mutex pattern is a known indicator of Rhadamanthys stealer activity, suggesting the presence of this malware on the system.
The rule detects the creation of specific mutexes associated with the Beast ransomware. It looks for mutex names 'BEAST HERE?'. This activity is indicative of the Beast ransomware executing on a Windows system, likely as part of its encryption or operational phases.
This rule detects the presence of specific mutex names associated with CastleRAT malware activity. The detection is based on a predefined list of unique mutex strings that CastleRAT is known to use for process synchronization or to indicate its presence on a system. The rule triggers if any of these mutex names are observed, indicating a high likelihood of CastleRAT infection.
The rule detects the creation of specific mutexes ('tech') that are known to be associated with Hermes ransomware activity. This detection is based on monitoring process creation events for these mutex names.
This rule detects the creation of a specific mutex named 'DoYouWantToHaveSexWithCuongDong'. This mutex name is known to be associated with Babuk ransomware activity. The detection is based on monitoring process creation events on Windows systems for the presence of this particular mutex.
This rule detects the creation of specific mutexes known to be associated with Dark Crystal RAT (Remote Access Trojan) activity. The rule looks for two distinct mutex names: 'DCR_MUTEX-<20_random_alphanumeric_characters>' and 'DcRatMutex_qwqdanchun'. The presence of these mutexes indicates a high likelihood of Dark Crystal RAT infection or execution on a Windows system.
This rule detects the creation of specific mutexes that are known to be associated with Zenrat malware activity. The rule specifically looks for a mutex named 'System.Byte[]'. The presence of this mutex name is considered indicative of Zenrat malware.
This rule detects the creation of processes that utilize specific mutex names associated with the Gamarue backdoor. The detection is based on a direct match of the 'MutexName' field against a predefined list of known Gamarue mutexes. The rule aims to identify potential Gamarue backdoor activity on Windows systems by monitoring process creation events for these unique mutex identifiers.
Page 1 of 21