Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
684 detections
Filters
Last updated
All Time
Detection languages
430
131
28
27
26
Contributors
418
94
69
25
21
Categories
20,443
11,831
5,875
5,151
4,864
684
Platforms
653
44
16
10
5
Products / Services
105
89
33
22
13
MITRE Techniques
580
574
171
157
131
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects high-volume file renaming activity where the new file extensions correspond to common ransomware patterns (e.g., .locked, .encrypted, .wncry). The rule excludes processes signed by reputable vendors to reduce noise.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
Detects the high-tempo Medusa ransomware encryption phase by identifying a large number of file renaming operations that append the '.medusa' extension within a short timeframe (1 minute). This rule specifically looks for more than 50 such rename events per device per minute.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects execution of the Prinz Eugen Go-based ransomware binary (servertool.exe) with the --delete flag, which instructs the encryptor to remove original plaintext files after encryption. The binary is known to execute from user-writable paths such as Music and OneDrive directories.
Detects the execution of command-line archiving utilities (7z, rar, tar) invoked by common scripting engines (PowerShell, CMD, Python, etc.) targeting typical staging directories (Temp, Public, AppData, ProgramData). This pattern is frequently observed during the data staging phase of an attack, where adversaries encrypt or compress gathered files for eventual exfiltration.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
Detects high-frequency file modifications or renames targeting file extensions commonly associated with ransomware. The rule monitors for a threshold of more than 20 file operations within a short timeframe by a specific process on an endpoint, indicating a potential mass encryption event.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Detects rapid sequential file rename/write operations across multiple directories within a short window, which is a behavioral signature of active ransomware encryption activity. The rule specifically looks for more than 200 file operations (renamed or created) with a file extension matching a 4-8 character alphanumeric pattern, across more than 5 unique folders, all occurring within a 2-minute window and completing within 120 seconds.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
Detects the creation, modification, or renaming of files with the '.prinzeugen' extension, which is commonly associated with ransomware activity. The rule aggregates these events by device and time, alerting if 10 or more such files are observed within an hour, indicating potential widespread encryption.
This rule detects potential ransomware activity by identifying rapid bulk file modifications or renames that result in files adopting extensions commonly associated with ransomware encryption. It looks for a high volume of file events (creation, modification, rename) within a short timeframe (1 hour) where the new file extensions match a predefined list of ransomware-specific extensions.
Page 9 of 33