Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
This rule detects the creation of specific mutexes known to be associated with Ryuk ransomware activity. The rule specifically looks for a mutex named 'rykmutex'. The presence of this mutex indicates a high probability of Ryuk ransomware execution on the system.
This rule detects the creation of specific mutexes associated with the ProjectWood backdoor. The detection is based on the presence of the mutex name 'IMPROVING CLIENT Want Wood To Exit?'. This activity is indicative of the ProjectWood backdoor running on a Windows system.
The rule detects the creation of specific mutex names associated with Money Message ransomware. It looks for the mutex '12345-12345-12235-12354' during process creation events on Windows systems. The presence of this mutex indicates potential Money Message ransomware activity.
The rule detects the creation of specific mutexes known to be associated with Mamona ransomware. It looks for the mutex name 'Global\Fxo16jmdgujs437' during process creation events on Windows systems. The presence of this mutex indicates potential Mamona ransomware activity.
This rule detects the creation of specific mutex names associated with DragonForce ransomware. The detection is triggered when a process creates a mutex named 'dragonforce_encrypted_system'. This activity is indicative of the DragonForce ransomware encrypting a system, as mutexes are often used by malware to ensure only one instance is running or to signal certain operational states.
The rule detects the creation of a process that utilizes a specific mutex name, 'YourMutex'. This mutex name is associated with Atlas Clipper malware activity. The detection aims to identify potential Atlas Clipper infections by monitoring for this known indicator.
This rule detects the creation of specific mutexes associated with the Xeno RAT malware. It looks for mutex names starting with 'xeno_rat_nd' followed by five alphanumeric characters, optionally ending with '-admin'. The detection is based on the `MutexName` field within process creation logs.
This rule detects the creation of specific mutex names associated with the 'Underground' ransomware. The detection is based on a direct match of the mutex name '8DC1F7B9D2F4EA58'. The rule is designed to identify activity related to this particular ransomware variant.
This rule detects the creation of specific mutex names associated with TeslaCrypt ransomware activity. The detection is based on a static list of known mutex strings: '8765-123rvr4', '2134-1234-1324-2134-1324-2134', 'System1230123', 'dslhufdks3', and '9_9_9_9'. The rule triggers when any of these mutex names are observed, indicating potential TeslaCrypt infection or execution.
This rule detects the creation of specific mutexes known to be associated with SpiceRAT malware activity. The detection is based on two distinct mutex names: '{00866F68-6C46-4ABD-A8D6-2246FE482F99}' and '{00861111-3333-4ABD-GGGG-2246FE482F99}'. The rule monitors process creation events on Windows systems for the presence of these mutex names.
Page 6 of 21