Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
2
2
Categories
2
2
2
2
Platforms
3
1
Products / Services
2
1
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
1
IDS Protocols
1
Detects enabling of reversible password encryption in Active Directory
This rule detects network traffic indicating that reversible password encryption might be enabled in Active Directory. It specifically looks for the string "AllowReversiblePasswordEncryption" in TCP traffic destined for port 389 (LDAP). Enabling reversible password encryption stores passwords in a format that can be easily decrypted, making them vulnerable to theft if the system is compromised.
This YARA rule detects the AwesomeScott ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for a combination of three distinct byte sequences related to file encryption ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) and one byte sequence related to file discovery ($find_files). All identified patterns must be present for a match, along with the standard Windows executable MZ header (uint16(0) == 0x5A4D).
This YARA rule detects the Kangaroo ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes (hex patterns) that are characteristic of the Kangaroo ransomware's code for encrypting files, locating files on the system, and enumerating resources.