Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
Detects known mutexes associated with Keyzetsu Clipper activity. This rule specifically looks for the presence of a mutex named '2ILdX2JpexVZieT6mPv2i6Jp3HNFPlby' during process creation events on Windows systems.
The rule detects the creation of specific mutexes known to be associated with the Gunra ransomware. It looks for the mutex name 'kjsidugiaadf99439' during process creation events on Windows systems. The presence of this mutex indicates potential Gunra ransomware activity, which typically involves encrypting files and demanding a ransom, falling under the impact category of data encryption.
This rule detects the creation of specific mutexes associated with the DarkAngels ransomware. The detection is based on the presence of the mutex name 'DarkAngels'. The rule aims to identify potential DarkAngels ransomware activity on Windows systems by monitoring process creation events for these mutexes.
This rule detects the creation of specific mutex names associated with Zola ransomware activity. The detection is based on the presence of the mutex '4B991369-7C7C-47AA-A81E-EF6ED1F5E24C'. The rule monitors process creation events on Windows systems to identify these mutexes, which are indicators of Zola ransomware execution or presence.
The rule detects the creation of specific mutexes associated with ZCryptor ransomware activity. It specifically looks for a mutex named 'zcrypt1.0'. The detection is based on process creation logs from Windows systems.
This rule detects the creation of processes that utilize specific mutex names associated with the Yokai backdoor. The detection is based on the presence of the mutex name 'k1tpddvivh74fo1et725okr1c1'. This activity is indicative of the Yokai backdoor running on a system, potentially for persistence or to ensure a single instance of the malware.
This rule detects the creation of specific mutexes associated with the UDPGangster backdoor. The detection logic looks for the mutex name 'xhxhxhxhxhxpp'. The presence of this mutex name indicates potential UDPGangster backdoor activity on the system.
This rule detects the creation of specific mutexes known to be associated with the REMCOS Remote Access Trojan (RAT). The rule looks for several distinct mutex names, including 'MARE_IS_BEAUTIFUL_EX', 'Rmc-<uniqueid>', 'Remcos_Mutex_Inj', 'remcos_<uniqueid>', 'Remcos-<uniqueid>', and 'Mutex_RemWatchdog'. The presence of any of these mutexes indicates potential REMCOS RAT activity on a Windows system.
The rule detects the creation of specific mutex names associated with Nitrogen ransomware activity. It specifically looks for the mutex 'nvxkjcv7yxctvgsdfjhv6esdvsx'. This indicates the presence or execution of the Nitrogen ransomware on a Windows system.
The rule detects the creation of a specific mutex named 'dawdhahdaw'. This mutex name is associated with d0glun ransomware activity. The detection is based on monitoring process creation events on Windows systems.
Page 3 of 21