Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
This rule detects the creation of specific mutexes known to be associated with Cl0p ransomware activity. The detection is based on a predefined list of unique mutex names that Cl0p ransomware has been observed to use. The rule triggers when any of these mutex names are identified during process creation events on Windows systems.
Detects the creation of a process that utilizes the mutex name 'FAUST'. This specific mutex name is associated with AiLock ransomware activity, indicating a potential infection or execution of this malware.
This rule detects the creation of specific mutexes known to be associated with the Xtreme RAT (Remote Access Trojan) malware. The detection is triggered when a process creates a mutex named 'XTREMEUPDATE'. The presence of these mutexes indicates potential Xtreme RAT activity on a Windows system.
Detects known mutexes associated with XLoader stealer activity by looking for specific mutex names created during process creation events on Windows systems.
This rule detects the creation of processes that utilize specific mutex names associated with XenoStealer malware. The detection is based on the presence of the mutex 'aMdFrsHoGcGgAKUyLCoEIuoHpvwCAzaz', which is a known indicator of XenoStealer activity. This activity falls under the 'process_creation' category within Windows environments.
The rule detects the creation of processes that utilize specific mutex names associated with the WailingCrab backdoor. Specifically, it looks for a mutex named '823264'. This activity is indicative of the WailingCrab malware operating on a Windows system.
The rule detects the creation of a specific mutex named 'Global\VohukMutex'. This mutex name is associated with Vohuk ransomware activity, indicating a potential infection or execution of this malware.
The rule detects the presence of specific mutex names associated with the VipersoftX stealer. It looks for two distinct mutex names: 'acb2f45f62c34c94bbd6e86734eb01a1' and '8cda13f8-a407-4a48-8284-411709e090'. The detection is based on process creation events on Windows systems where these mutex names are observed.
The rule detects the creation of a specific mutex name: 'abcdefghijklmnoklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890'. This mutex name is associated with ROADSWEEP ransomware activity. The detection is based on monitoring process creation events in Windows environments for the presence of this exact mutex name.
The rule detects the creation of specific mutex names associated with RevengeRAT malware. It looks for mutexes named 'RV_MUTEX-<random>', which are known indicators of RevengeRAT activity. This detection focuses on the process creation logs within Windows environments to identify these mutexes.
Page 4 of 21