Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
3
2
1
1
Categories
4
3
3
2
2
Platforms
7
Products / Services
1
1
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
Detects the creation of scheduled tasks using schtasks.exe that exhibit behaviors associated with common remote execution tools (e.g., Impacket's atexec.py) or staging from insecure directories like Temp, ProgramData, or network shares. These patterns are frequently used by threat actors, including INC Ransom, for lateral movement and remote execution of malicious payloads.
Detects high-volume file modification events resulting in files renamed with the .inc extension, which is a characteristic behavior of the INC ransomware strain. The rule monitors for more than 50 such modifications on a single host within a 10-minute window, serving as an indicator of active encryption and potential ransomware impact.
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
Detects the execution of INC ransomware utilizing specific command-line arguments (--sup, --hide, --mode medium) typically staged from the C:\perflogs\ directory. This pattern indicates active ransomware execution during the impact phase of an attack.
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects techniques used by the INC Ransomware Group, including the execution of their RainINC payload from C:\PerfLogs and the abuse of a renamed Restic binary for data exfiltration.
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
