Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
37 detections
Filters
Last updated
All Time
Detection languages
23
4
3
2
2
Contributors
8
7
7
5
4
Categories
11
10
8
6
6
Platforms
34
4
2
1
1
Products / Services
13
5
3
2
2
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
2
IDS Protocols
1
1
Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects registry value settings that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects registry value settings that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
The analytic identifies modifications to the TranscodedWallpaper file in the wallpaper theme directory, excluding changes made by explorer.exe. This detection leverages the Endpoint.Processes and Endpoint.Filesystem data models to correlate process activity with file modifications. This activity is significant as it may indicate an adversary attempting to deface or change the desktop wallpaper of a targeted host, a tactic often used to signal compromise or deliver a message. If confirmed malicious, this could be a sign of unauthorized access and tampering, potentially leading to further system compromise or data exfiltration.
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
Yara rule that detects Albabat ransomware.
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
This YARA rule detects the Acepy ransomware by identifying specific byte patterns associated with its core functionalities: finding files to encrypt, performing the encryption process, and dropping a ransom note. The rule requires all three patterns to be present within a Windows executable file (indicated by the MZ header) to trigger a detection.
Page 2 of 2