Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
This rule detects the creation of specific mutexes that are known to be associated with the Mars Stealer malware. The rule looks for three distinct mutex names: '67820366929896267194', '92550737836278980100', and '86223203794583053453'. The detection is based on process creation logs from Windows systems, specifically monitoring for these unique mutex names. The presence of any of these mutexes indicates potential Mars Stealer activity on the system.
This rule detects the creation of specific mutexes (89A72EF01) that are known to be associated with Mallox ransomware activity. The presence of these mutexes indicates a high probability of Mallox ransomware execution on a Windows system.
The rule detects the creation of processes that utilize specific mutex names associated with MagnetLoader malware. It specifically looks for the mutex name 'SM0:220:304:WilStaging_02_p1h'. Detection of this mutex name indicates potential MagnetLoader activity on the system.
The rule detects the creation of specific mutexes known to be associated with the Lumma stealer malware. It looks for a mutex named 'sodfksdkfalksdasgpkprgasdgrrkgwhrterheegwsdfwef'. The detection is based on process creation events in Windows environments.
The rule detects the creation of a process that utilizes a mutex named 'wolf'. This specific mutex name is associated with Lorenz ransomware activity. The detection is based on monitoring process creation events and checking for the presence of this particular mutex name.
The rule detects the creation of specific mutex names associated with Kraken ransomware. It looks for mutexes named 'Microsoft-Kraken-<ComputerName>'. The detection logic is based on the 'process_creation' log source category on Windows systems, specifically monitoring the 'MutexName' field.
Page 21 of 21