Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
The rule detects the presence of specific mutex names ('PAYDAYDAYPAY') that are known to be associated with BTCWare ransomware activity. This detection is based on process creation events where these mutexes are observed.
The rule detects the creation of specific mutexes known to be associated with Scarabey ransomware. The detection is triggered when a process creates a mutex with the name 'STOPSCARABSTOPSCARABSTOPSCARABSTOPSCARABSTOPSCARAB'.
Detects known mutexes associated with DireWolf ransomware activity. Specifically, it looks for the mutex named 'Global\direwolfAppMutex'.
Detects known mutexes associated with Typhon stealer activity. The rule specifically looks for the mutex name 'GOJJL2LPIZM04XC0NQ4I' in process creation events on Windows systems.
This rule detects the creation of processes that utilize specific mutex names associated with the Phoenix backdoor. The detection is triggered when a process creates a mutex named 'sysprocupdate.exe'. This activity is indicative of the Phoenix backdoor attempting to ensure only a single instance of itself is running on a system, a common technique for malware persistence and control.
The rule detects the creation of specific mutex names ('m23071644') associated with Makop ransomware activity. It monitors process creation events on Windows systems for these mutexes, indicating potential ransomware infection or execution.
The rule detects the creation of processes that utilize specific mutex names ('BOGLVGAU') known to be associated with HijackLoader malware activity. This detection is based on monitoring process creation events and checking for the presence of these unique mutex names.
The rule detects the creation of processes that utilize specific mutex names associated with the Allcome clipper malware. Specifically, it looks for the mutex name '08841d-18c7-4e2d-f7e29d'. This indicates potential Allcome clipper activity on a Windows system.
This rule detects the creation of processes that utilize specific mutex names associated with YaRAT (Yet Another Remote Access Tool) malware. Specifically, it looks for the mutex name 'YandexDisk'. The presence of this mutex name is a strong indicator of YaRAT activity, as it is a known identifier for this particular RAT. This detection helps identify command and control (C2) communication or other malicious operations performed by YaRAT on a compromised system.
The rule detects the creation of specific mutexes known to be associated with Quasar RAT activity. It looks for mutex names matching 'QSR_MUTEX_<uniqueid>'.
Page 2 of 21