| elastic |
AWS S3 Object Encryption Using External KMS Key |
production |
2026-10-06 |
| elastic |
ESXi Payload Executed Against Datastore |
production |
2026-09-30 |
| elastic |
Unusual AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
Potential AWS S3 Bucket Ransomware Note Uploaded |
production |
2026-09-18 |
| elastic |
Suspicious File Renamed via SMB |
production |
2026-09-18 |
| elastic |
Potential Ransomware Behavior - Note Files by System |
production |
2026-09-18 |
| elastic |
PowerShell Script with Encryption/Decryption Capabilities |
production |
2026-09-18 |
| elastic |
Potential NFS Destructive Operation Burst |
production |
2026-09-18 |
| elastic |
Potential Linux Ransomware Note Creation Detected |
production |
2026-09-18 |
| elastic |
Suspicious Data Encryption via OpenSSL Utility |
production |
2026-09-18 |
| elastic |
Potential Ransomware Note File Dropped via SMB |
production |
2026-09-18 |
| elastic |
Suspicious Renaming of ESXI Files |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Security Compliance Potential Ransomware Activity |
production |
2026-09-18 |
| elastic |
Ransomware - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Ransomware - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Excessive AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| sigma |
Load Of RstrtMgr.DLL By An Uncommon Process |
test |
2026-07-28 |
| sigma |
Lynx Ransomware Execution Pattern |
experimental |
2026-06-25 |
| sigma |
Antivirus - Ransomware Signature |
test |
2026-06-15 |
| splunk |
AWS Detect Users with KMS keys performing encryption S3 |
production |
2026-05-13 |
| splunk |
High Process Termination Frequency |
production |
2026-05-13 |
| splunk |
Ransomware Notes bulk creation |
production |
2026-05-13 |
| splunk |
Ryuk Test Files Detected |
production |
2026-05-13 |
| splunk |
Windows DiskCryptor Usage |
production |
2026-05-13 |
| splunk |
ASL AWS Detect Users creating keys with encrypt policy without MFA |
production |
2026-05-13 |
| splunk |
AWS Detect Users creating keys with encrypt policy without MFA |
production |
2026-05-13 |
| splunk |
Samsam Test File Write |
production |
2026-05-13 |
| splunk |
Windows .Key File Creation in Root Directory |
production |
2026-05-13 |
| splunk |
Windows BitLocker Suspicious Command Usage |
production |
2026-05-13 |
| sigma |
Suspicious Creation TXT File in User Desktop |
test |
2026-01-09 |
| sigma |
WannaCry Ransomware Activity |
test |
2025-10-18 |
| sigma |
AWS KMS Imported Key Material Usage |
experimental |
2025-10-18 |
| suricata |
ET MALWARE Prince Ransomware GET Wallpaper M3 |
rev 1 |
2025-09-19 |
| suricata |
ET MALWARE Prince Ransomware GET Wallpaper M1 |
rev 1 |
2025-09-19 |
| snort |
ET TROJAN Prince Ransomware GET Wallpaper M3 |
rev 1 |
2025-09-19 |
| snort |
ET TROJAN Prince Ransomware GET Wallpaper M2 |
rev 1 |
2025-09-19 |
| snort |
ET TROJAN Prince Ransomware GET Wallpaper M1 |
rev 1 |
2025-09-19 |
| suricata |
ET MALWARE Prince Ransomware GET Wallpaper M2 |
rev 1 |
2025-09-19 |
| sigma |
FunkLocker Ransomware File Creation |
experimental |
2025-08-08 |
| elastic |
Suspicious File Changes Activity Detected |
deprecated |
2024-07-18 |
| suricata |
ET MALWARE CryptoShield Ransomware Checkin |
rev 7 |
2024-05-04 |
| suricata |
ET MALWARE Nuke Ransomware Checkin |
rev 7 |
2024-05-02 |
| suricata |
ET MALWARE Win32/MereTam.A Ransomware CnC Checkin |
rev 4 |
2024-05-02 |
| suricata |
ET MALWARE Win32/Aura Ransomware CnC Activity |
rev 4 |
2024-05-01 |
| suricata |
ET MALWARE Iron/Maktub Locker Ransomware CnC Checkin |
rev 4 |
2024-05-01 |
| suricata |
ET MALWARE BandarChor Ransomware Checkin |
rev 10 |
2024-05-01 |
| suricata |
ET MALWARE ApolloLocker Ransomware CnC Checkin 2 |
rev 5 |
2024-05-01 |
| suricata |
ET MALWARE ApolloLocker Ransomware CnC Checkin |
rev 5 |
2024-05-01 |
| suricata |
ET MALWARE Win32/CryptFile2 / Revenge Ransomware Checkin M3 |
rev 6 |
2024-05-01 |
| suricata |
ET MALWARE MSIL/Unk.HT-Based Ransomware CnC Checkin |
rev 5 |
2024-05-01 |
| suricata |
ET MALWARE PS/SunCrypt Ransomware CnC Activity |
rev 3 |
2024-05-01 |
| suricata |
ET MALWARE [PTsecurity] Donut Ransomware CnC Checkin |
rev 6 |
2024-05-01 |
| suricata |
ET MALWARE Observed Buran Ransomware UA |
rev 4 |
2024-04-30 |
| suricata |
ET MALWARE MSIL/HadesLocker Ransomware Checkin |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE Win32/Satana Ransomware Checkin |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE CNRarypt Ransomware CnC Activity |
rev 3 |
2024-04-30 |
| suricata |
ET MALWARE Observed Buran Ransomware UA |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE Buran Ransomware Activity M1 |
rev 5 |
2024-04-29 |
| suricata |
ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M2 |
rev 5 |
2024-04-29 |
| suricata |
ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M1 |
rev 5 |
2024-04-29 |
| suricata |
ET MALWARE Win32/7ev3n Ransomware Initial Checkin |
rev 5 |
2024-04-29 |
| suricata |
ET MALWARE Sage Ransomware Checkin |
rev 6 |
2024-04-28 |
| suricata |
ET MALWARE [ANY.RUN] RCRU64 Ransomware Variant CnC Activity |
rev 2 |
2024-04-26 |
| suricata |
ET MALWARE Observed Karen Ransomware Powershell Loader |
rev 2 |
2024-04-25 |
| suricata |
ET MALWARE MSIL/Khonsri Ransomware CnC Activity |
rev 2 |
2024-04-25 |
| suricata |
ET MALWARE Observed Karen Ransomware CnC Checkin |
rev 2 |
2024-04-25 |
| suricata |
ET MALWARE Win32/MereTam.A Ransomware CnC Init Activity |
rev 2 |
2024-04-24 |
| suricata |
ET MALWARE MSIL/NoCry Ransomware Checkin Via Discord |
rev 2 |
2024-04-24 |
| suricata |
ET MALWARE Win32/Braincrypt Ransomware CnC Checkin |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE SAD Ransomware CnC Activity |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Aurora/OneKeyLocker Ransomware CnC Checkin |
rev 3 |
2024-04-20 |
| suricata |
ET MALWARE MSIL/NewHT Ransomware CnC Checkin |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Win32/Jackpot Ransomware CnC Checkin |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE FAKBEN Ransomware |
rev 3 |
2024-04-20 |
| suricata |
ET MALWARE Lyposit Ransomware Checkin 2 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE CryptoPatronum Ransomware CnC Checkin |
rev 2 |
2024-04-20 |
| suricata |
ET MALWARE Nemty Ransomware CnC Checkin |
rev 2 |
2024-04-20 |
| suricata |
ET MALWARE ShivaGood Ransomware CnC Checkin |
rev 2 |
2024-04-20 |
| suricata |
ET MALWARE Win32/Snatch Ransomware - Encryption Started |
rev 2 |
2024-04-20 |
| suricata |
ET MALWARE Cyborg Ransomware - Downloading Desktop Background |
rev 2 |
2024-04-20 |
| suricata |
ET MALWARE Spora Ransomware Checkin |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Win32/7ev3n Ransomware Process Checkin |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE W32/Virus-Encoder Ransomware Checkin |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 5 |
2024-04-19 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 5 |
2024-04-19 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 5 |
2024-04-19 |
| suricata |
ET MALWARE Observed Buran Ransomware UA |
rev 6 |
2024-04-18 |
| suricata |
ET MALWARE MoneroPay Ransomware Payment Activity |
rev 4 |
2024-04-14 |
| suricata |
ET MALWARE MSIL/Runsome Ransomware CnC Checkin |
rev 6 |
2024-04-14 |
| suricata |
ET MALWARE Jaff Ransomware Checkin M1 |
rev 7 |
2024-04-14 |
| suricata |
ET MALWARE Ransomware.Hidden-Tear Variant CnC Checkin |
rev 8 |
2024-04-14 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Observed DNS Query to Known Fenrir Ransomware CnC Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Spora Ransomware DNS Query |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Spora Ransomware DNS Query |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Observed CDC Ransomware User-Agent |
rev 4 |
2024-04-13 |
| suricata |
ET MALWARE Spora Ransomware DNS Query |
rev 7 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 7 |
2024-04-13 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE LooCipher Ransomware Onion Domain |
rev 4 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware Locky .onion Payment Domain |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware Locky .onion Payment Domain |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware Locky .onion Payment Domain |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE OSX/KeRanger Ransomware CnC DNS Request 1 |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE OSX/KeRanger Ransomware CnC DNS Request 2 |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE OSX/KeRanger Ransomware CnC DNS Request 3 |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE OSX/KeRanger Ransomware CnC DNS Request 4 |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware Locky Possible Payment Page |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware/Cerber Onion Domain Lookup |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware CrypMIC Payment Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Ransomware CrypMIC Payment Onion Domain |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE Lyposit Ransomware Checkin 1 |
rev 9 |
2024-04-12 |
| suricata |
ET MALWARE Win32/Striked Ransomware CnC Checkin |
rev 3 |
2024-04-08 |
| snort |
ET TROJAN Sage Ransomware Checkin Primer |
rev 3 |
2024-04-08 |
| suricata |
ET MALWARE Galock Ransomware Check-in |
rev 5 |
2024-04-07 |
| suricata |
ET MALWARE CBReplay.P Ransomware |
rev 5 |
2024-04-07 |
| suricata |
ET MALWARE CerberTear Ransomware CnC Checkin |
rev 5 |
2024-04-06 |
| suricata |
ET MALWARE MSIL/Alcatrez Locker Ransomware CnC Checkin |
rev 5 |
2024-04-06 |
| suricata |
ET MALWARE Jaff Ransomware Checkin |
rev 7 |
2024-04-06 |
| suricata |
ET MALWARE Sage Ransomware Checkin Primer |
rev 8 |
2024-04-06 |
| suricata |
ET MALWARE Magician/M461c14n Ransomware CnC Checkin |
rev 3 |
2024-04-04 |
| suricata |
ET MALWARE Reimageplus Ransomware Checkin |
rev 2 |
2024-04-04 |
| suricata |
ET MALWARE Win32/Avaddon Ransomware Style External IP Address Check |
rev 3 |
2024-04-04 |
| suricata |
ET MALWARE Ragnarok Ransomware CnC Activity M1 |
rev 2 |
2024-04-04 |
| suricata |
ET MALWARE Mermaid Ransomware Variant CnC Activity M3 |
rev 2 |
2024-04-04 |
| suricata |
ET MALWARE Win32/AnteFrigus Ransomware Activity |
rev 2 |
2024-04-04 |
| suricata |
ET MALWARE Jaff Ransomware Checkin |
rev 7 |
2024-03-27 |
| suricata |
ET MALWARE Loki Locker Ransomware CnC Activity |
rev 3 |
2024-03-26 |
| suricata |
ET MALWARE slock Ransomware CnC Activity |
rev 2 |
2024-03-26 |
| suricata |
ET MALWARE MAZE Ransomware Payment Domain in DNS Lookup |
rev 3 |
2024-03-25 |
| suricata |
ET MALWARE MAZE Ransomware Payment Domain DNS Lookup |
rev 3 |
2024-03-25 |
| suricata |
ET MALWARE Linux DarkRadiation Ransomware Activity Attack Check |
rev 2 |
2024-03-25 |
| suricata |
ET MALWARE Observed DNS Query to known Avaddon Ransomware Payment Domain |
rev 4 |
2024-03-25 |
| suricata |
ET MALWARE [PTsecurity] MZRevenge Ransomware Server Response |
rev 3 |
2024-03-17 |
| suricata |
ET MALWARE Magniber Ransomware Retrieving Instructions |
rev 2 |
2024-03-14 |
| suricata |
ET MALWARE Evil JS Ransomware |
rev 3 |
2024-03-14 |
| suricata |
ET WEB_CLIENT JS Browser Based Ransomware |
rev 3 |
2024-03-13 |
| suricata |
ET MALWARE Galock Ransomware Command |
rev 4 |
2024-03-13 |
| suricata |
ET MALWARE Gimemo Ransomware Checkin |
rev 5 |
2024-03-13 |
| suricata |
ET MALWARE Win32/CryptFile2 Ransomware Checkin M2 |
rev 5 |
2024-03-11 |
| suricata |
ET MALWARE MRCR1 Ransomware Checkin M1 |
rev 4 |
2024-03-07 |
| suricata |
ET MALWARE Locky Ransomware Writing Instructions via SMB |
rev 2 |
2024-03-07 |
| suricata |
ET MALWARE Locky Ransomware Renaming File via SMB |
rev 2 |
2024-03-07 |
| suricata |
ET MALWARE Ranscam Ransomware Contact Form |
rev 4 |
2024-03-07 |
| suricata |
ET MALWARE Towerweb Ransomware Landing Page |
rev 5 |
2024-03-07 |
| suricata |
ET MALWARE BandarChor/CryptON Ransomware Checkin |
rev 3 |
2024-03-07 |
| suricata |
ET MALWARE Possible CryptXXX Ransomware Renaming Encrypted File SMB v2 |
rev 3 |
2024-03-07 |
| suricata |
ET MALWARE MRCR1 Ransomware Checkin M2 |
rev 4 |
2024-03-07 |
| suricata |
ET MALWARE Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 Unicode |
rev 2 |
2024-03-07 |
| suricata |
ET MALWARE Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v2 |
rev 7 |
2024-03-07 |
| suricata |
ET MALWARE Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 ASCII |
rev 2 |
2024-03-07 |
| suricata |
ET MALWARE Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 Unicode |
rev 4 |
2024-03-07 |
| suricata |
ET MALWARE Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 ASCII |
rev 2 |
2024-03-07 |
| sigma |
Load Of RstrtMgr.DLL By A Suspicious Process |
test |
2023-11-28 |
| sigma |
Suspicious Appended Extension |
test |
2023-11-11 |
| sigma |
Portable Gpg.EXE Execution |
test |
2023-11-10 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M1 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M2 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M2 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M3 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M3 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M4 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M4 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M1 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-03 |
| sigma |
Renamed Gpg.EXE Execution |
test |
2023-08-09 |
| snort |
ET TROJAN [ANY.RUN] RCRU64 Ransomware Variant CnC Activity |
rev 1 |
2023-06-23 |
| sigma |
BlueSky Ransomware Artefacts |
test |
2023-05-23 |
| snort |
ET INFO HTTP Request to Lockbit Ransomware Payment Domain |
rev 4 |
2023-05-22 |
| suricata |
ET INFO HTTP Request to Lockbit Ransomware Payment Domain |
rev 3 |
2023-05-22 |
| snort |
ET TROJAN Observed Karen Ransomware CnC Checkin |
rev 2 |
2023-04-05 |
| snort |
ET TROJAN Linux DarkRadiation Ransomware Telegram Activity M1 |
rev 2 |
2023-04-04 |
| snort |
ET TROJAN Possible Linux DarkRadiation Ransomware Telegram Activity |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Linux DarkRadiation Ransomware Telegram Activity M3 |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Linux DarkRadiation Ransomware Telegram Activity M1 |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Possible Linux DarkRadiation Ransomware Telegram Activity |
rev 1 |
2023-03-14 |
| snort |
ET TROJAN Linux DarkRadiation Ransomware Telegram Activity M3 |
rev 1 |
2023-03-14 |
| sigma |
Potential Conti Ransomware Activity |
test |
2023-02-13 |
| sigma |
LockerGoga Ransomware Activity |
stable |
2023-02-03 |
| snort |
ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v2 |
rev 6 |
2022-10-10 |
| sigma |
Microsoft 365 - Potential Ransomware Activity |
test |
2022-10-09 |
| sigma |
Suspicious Reg Add BitLocker |
test |
2022-09-09 |
| snort |
ET TROJAN Win32/Nemty Ransomware Style Geo IP Check M2 |
rev 3 |
2022-05-03 |
| snort |
ET TROJAN Win32/Nemty Ransomware Style Geo IP Check M1 |
rev 3 |
2022-05-03 |
| snort |
ET TROJAN Towerweb Ransomware Landing Page |
rev 3 |
2022-05-03 |
| snort |
ET TROJAN Nuke Ransomware Checkin |
rev 3 |
2022-04-18 |
| suricata |
ET MALWARE Spora Ransomware SSL Certificate Detected |
rev 3 |
2022-03-23 |
| snort |
ET TROJAN Spora Ransomware SSL Certificate Detected |
rev 2 |
2022-03-23 |
| snort |
ET TROJAN Loki Locker Ransomware CnC Activity |
rev 2 |
2022-03-17 |
| snort |
ET TROJAN MSIL/Khonsri Ransomware CnC Activity |
rev 1 |
2021-12-14 |
| snort |
ET TROJAN slock Ransomware CnC Activity |
rev 2 |
2021-10-29 |
| snort |
ET TROJAN Observed Karen Ransomware Powershell Loader |
rev 1 |
2021-08-23 |
| sigma |
AWS EC2 Disable EBS Encryption |
stable |
2021-08-20 |
| snort |
ET TROJAN Linux DarkRadiation Ransomware Activity Attack Check |
rev 2 |
2021-06-23 |
| snort |
ET TROJAN MSIL/NoCry Ransomware Checkin Via Discord |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN CNRarypt Ransomware CnC Activity |
rev 1 |
2021-06-03 |
| suricata |
ET MALWARE Teslarvng Ransomware CnC Activity M3 |
rev 2 |
2021-05-24 |
| snort |
ET TELNET Teslarvng Ransomware CnC Activity M2 |
rev 2 |
2021-05-24 |
| snort |
ET TROJAN Teslarvng Ransomware CnC Activity M3 |
rev 2 |
2021-05-24 |
| snort |
ET TROJAN Teslarvng Ransomware CnC Activity M1 |
rev 1 |
2021-05-24 |
| suricata |
ET MALWARE Teslarvng Ransomware CnC Activity M1 |
rev 1 |
2021-05-24 |
| suricata |
ET MALWARE Teslarvng Ransomware CnC Activity M2 |
rev 2 |
2021-05-24 |
| suricata |
ET MALWARE NightfallGT Discord Nitro Ransomware |
rev 2 |
2021-05-19 |
| snort |
ET TROJAN NightfallGT Discord Nitro Ransomware |
rev 2 |
2021-05-19 |
| snort |
ET TROJAN Win32/MereTam.A Ransomware CnC Init Activity |
rev 2 |
2021-04-05 |
| snort |
ET TROJAN Win32/MereTam.A Ransomware CnC Checkin |
rev 2 |
2021-04-05 |
| snort |
ET TROJAN Black KingDom Ransomware Related Activity |
rev 2 |
2021-03-25 |
| suricata |
ET MALWARE Black KingDom Ransomware Related Activity |
rev 2 |
2021-03-25 |
| suricata |
ET MALWARE Possible Ransomware HTTP POST to Onion Link Domain |
rev 1 |
2021-03-19 |
| snort |
ET TROJAN Possible Ransomware HTTP POST to Onion Link Domain |
rev 2 |
2021-03-19 |
| snort |
ET TROJAN Jasmin Ransomware C2 Checkin |
rev 2 |
2021-03-15 |
| suricata |
ET MALWARE Jasmin Ransomware C2 Checkin |
rev 1 |
2021-03-15 |
| suricata |
ET MALWARE Observed DNS Query to Redkeeper Ransomware Domain |
rev 2 |
2020-11-16 |
| snort |
ET TROJAN [PTsecurity] MZRevenge Ransomware Server Response |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN Linkup Ransomware check-in |
rev 2 |
2020-11-10 |
| snort |
ET TROJAN Pay2Key Ransomware - Sending RSA Key |
rev 2 |
2020-11-09 |
| suricata |
ET MALWARE Pay2Key Ransomware - Sending RSA Key |
rev 1 |
2020-11-09 |
| suricata |
ET MALWARE Magniber Ransomware CnC Domain in DNS Lookup |
rev 2 |
2020-11-05 |
| suricata |
ET MALWARE Magniber Ransomware CnC Domain in DNS Lookup |
rev 2 |
2020-11-05 |
| suricata |
ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 |
rev 5 |
2020-10-09 |
| suricata |
ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 3 |
rev 6 |
2020-10-09 |
| suricata |
ET MALWARE Ragnarok Ransomware CnC Activity M2 |
rev 3 |
2020-10-05 |
| snort |
ET TROJAN Ragnarok Ransomware CnC Activity M2 |
rev 4 |
2020-10-05 |
| snort |
ET TROJAN PS/SunCrypt Ransomware CnC Activity |
rev 2 |
2020-09-24 |
| suricata |
ET MALWARE Revoyem Ransomware Check-in |
rev 6 |
2020-09-18 |
| suricata |
ET MALWARE HTTP Request for Possible ELF/LiLocked Ransomware Note |
rev 4 |
2020-09-17 |
| suricata |
ET MALWARE Shade Ransomware Payment Domain in DNS Lookup |
rev 3 |
2020-09-17 |
| snort |
ET TROJAN Reimageplus Ransomware Checkin |
rev 2 |
2020-09-11 |
| suricata |
ET MALWARE Aurora Ransomware CnC Checkin |
rev 4 |
2020-09-01 |
| suricata |
ET MALWARE ELF/Win32 Lucky Ransomware CnC Checkin |
rev 3 |
2020-08-27 |
| snort |
ET TROJAN Suspected Lockscreen Ransomware Activity |
rev 2 |
2020-08-07 |
| suricata |
ET MALWARE Suspected Lockscreen Ransomware Activity |
rev 1 |
2020-08-07 |
| suricata |
ET MALWARE Win32/CryptFile2 Ransomware Checkin |
rev 5 |
2020-08-03 |
| suricata |
ET MALWARE JS/RAA Ransomware check-in |
rev 3 |
2020-07-15 |
| snort |
ET TROJAN Win32/Avaddon Ransomware Style External IP Address Check |
rev 2 |
2020-06-05 |
| snort |
ET TROJAN Observed DNS Query to known Avaddon Ransomware Payment Domain |
rev 2 |
2020-06-05 |
| snort |
ET TROJAN Hakbit/Thanos Ransomware Exfil via FTP |
rev 2 |
2020-05-12 |
| suricata |
ET MALWARE Hakbit/Thanos Ransomware Exfil via FTP |
rev 1 |
2020-05-12 |
| snort |
ET TROJAN MAZE Ransomware Payment Domain DNS Lookup |
rev 2 |
2020-05-08 |
| suricata |
ET MALWARE W32/Tobfy.Ransomware Invalid URI CnC Request |
rev 5 |
2020-05-08 |
| snort |
ET TROJAN MAZE Ransomware Payment Domain in DNS Lookup |
rev 2 |
2020-05-08 |
| suricata |
ET MALWARE W32/Tobfy.Ransomware CnC Request - status.php |
rev 5 |
2020-05-08 |
| snort |
ET TROJAN Ragnarok Ransomware CnC Activity M1 |
rev 2 |
2020-05-06 |
| suricata |
ET MALWARE W32/DirCrypt.Ransomware CnC Checkin |
rev 4 |
2020-04-27 |
| suricata |
ET MALWARE Linkup Ransomware check-in |
rev 3 |
2020-04-27 |
| snort |
ET TROJAN Observed DNS Query to Redkeeper Ransomware Domain |
rev 2 |
2020-04-14 |
| snort |
ET TROJAN Magniber Ransomware CnC Domain in DNS Lookup |
rev 2 |
2020-03-05 |
| snort |
ET TROJAN Magniber Ransomware Retrieving Instructions |
rev 2 |
2020-03-05 |
| snort |
ET TROJAN Magniber Ransomware CnC Domain in DNS Lookup |
rev 2 |
2020-03-05 |
| snort |
ET TROJAN Baraka Ransomware CnC activity email SMTP |
rev 2 |
2020-02-28 |
| suricata |
ET MALWARE Baraka Ransomware CnC activity email SMTP |
rev 2 |
2020-02-28 |
| snort |
ET TROJAN CryptoPatronum Ransomware CnC Checkin |
rev 2 |
2020-02-04 |
| snort |
ET TROJAN Mermaid Ransomware Variant CnC Activity M3 |
rev 2 |
2020-01-24 |
| snort |
ET TROJAN Nemty Ransomware CnC Checkin |
rev 2 |
2020-01-17 |
| suricata |
ET MALWARE Nemty Ransomware Payment Page ID File Upload |
rev 1 |
2020-01-17 |
| snort |
ET TROJAN Nemty Ransomware Payment Page ID File Upload |
rev 2 |
2020-01-17 |
| snort |
ET TROJAN Satan/5ss5c Ransomware CnC Activity |
rev 2 |
2020-01-13 |
| suricata |
ET MALWARE Satan/5ss5c Ransomware CnC Activity |
rev 2 |
2020-01-13 |
| snort |
ET TROJAN Magician/M461c14n Ransomware CnC Checkin |
rev 2 |
2020-01-08 |
| suricata |
ET MALWARE Zeoticus Ransomware CnC Activity |
rev 2 |
2020-01-06 |
| snort |
ET TROJAN Zeoticus Ransomware CnC Activity |
rev 2 |
2020-01-06 |
| snort |
ET TROJAN Observed Buran Ransomware UA |
rev 2 |
2020-01-02 |
| snort |
ET TROJAN Observed Buran Ransomware UA |
rev 3 |
2020-01-02 |
| snort |
ET TROJAN Observed Buran Ransomware UA |
rev 3 |
2020-01-02 |
| snort |
ET TROJAN ShivaGood Ransomware CnC Checkin |
rev 2 |
2019-12-17 |
| snort |
ET TROJAN Win32/Snatch Ransomware - Encryption Started |
rev 2 |
2019-12-10 |
| snort |
ET TROJAN Cyborg Ransomware - Downloading Desktop Background |
rev 2 |
2019-11-25 |
| snort |
ET TROJAN Win32/AnteFrigus Ransomware Activity |
rev 2 |
2019-11-13 |
| suricata |
ET JA3 Hash - [Abuse.ch] Possible Troldesh Ransomware |
rev 2 |
2019-10-29 |
| suricata |
ET JA3 Hash - [Abuse.ch] Possible Ransomware |
rev 2 |
2019-10-29 |
| snort |
ET TROJAN HTTP Request for Possible ELF/LiLocked Ransomware Note |
rev 2 |
2019-09-09 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN Ransomware Locky .onion Payment Domain |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware Locky .onion Payment Domain |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware Locky .onion Payment Domain |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 1 |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 2 |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 3 |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN OSX/KeRanger Ransomware CnC DNS Request 4 |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware Locky Possible Payment Page |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware/Cerber Onion Domain Lookup |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Spora Ransomware DNS Query |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Spora Ransomware DNS Query |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN Ransomware CrypMIC Payment Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN Ransomware CrypMIC Payment Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 4 |
2019-08-28 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN ABUSE.CH Ransomware/Cerber Onion Domain Lookup |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN Observed DNS Query to Known Fenrir Ransomware CnC Domain |
rev 2 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN CryptON/Nemesis/X3M Ransomware Onion Domain |
rev 3 |
2019-08-28 |
| snort |
ET TROJAN Spora Ransomware DNS Query |
rev 4 |
2019-08-28 |
| snort |
ET TROJAN Aurora Ransomware CnC Checkin |
rev 4 |
2019-08-16 |
| suricata |
ET MALWARE Possible Chimera Ransomware - Bitmessage Activity |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Executioner Ransomware Reporting Infection via SMTP |
rev 1 |
2019-07-26 |
| snort |
ET TROJAN LooCipher Ransomware Onion Domain |
rev 2 |
2019-07-24 |
| snort |
ET TROJAN Buran Ransomware Activity M1 |
rev 2 |
2019-06-10 |
| snort |
ET TROJAN Shade Ransomware Payment Domain in DNS Lookup |
rev 2 |
2019-05-24 |
| snort |
ET TROJAN Observed CDC Ransomware User-Agent |
rev 2 |
2019-02-08 |
| snort |
ET TROJAN ELF/Win32 Lucky Ransomware CnC Checkin |
rev 2 |
2018-12-13 |
| snort |
ET TROJAN Win32/Aura Ransomware CnC Activity |
rev 2 |
2018-09-06 |
| snort |
ET TROJAN [PTsecurity] Donut Ransomware CnC Checkin |
rev 2 |
2018-06-19 |
| snort |
ET TROJAN Aurora/OneKeyLocker Ransomware CnC Checkin |
rev 2 |
2018-05-30 |
| snort |
ET TROJAN Iron/Maktub Locker Ransomware CnC Checkin |
rev 2 |
2018-04-12 |
| snort |
ET TROJAN MoneroPay Ransomware Payment Activity |
rev 2 |
2018-01-16 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 2 |
2017-11-14 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 2 |
2017-11-14 |
| snort |
ET TROJAN DeepEnd Research Ransomware CrypMIC Payment Onion Domain |
rev 2 |
2017-11-14 |
| snort |
ET TROJAN SAD Ransomware CnC Activity |
rev 2 |
2017-11-03 |
| snort |
ET TROJAN ApolloLocker Ransomware CnC Checkin 2 |
rev 1 |
2017-09-06 |
| snort |
ET TROJAN ApolloLocker Ransomware CnC Checkin |
rev 2 |
2017-09-06 |
| snort |
ET TROJAN Win32/Striked Ransomware CnC Checkin |
rev 1 |
2017-07-13 |
| snort |
ET TROJAN Executioner Ransomware Reporting Infection via SMTP |
rev 1 |
2017-06-06 |
| snort |
ET TROJAN MSIL/Unk.HT-Based Ransomware CnC Checkin |
rev 1 |
2017-06-06 |
| snort |
ET TROJAN Jaff Ransomware Checkin |
rev 1 |
2017-05-31 |
| snort |
ET TROJAN Possible CryptXXX Ransomware Renaming Encrypted File SMB v2 |
rev 2 |
2017-05-30 |
| snort |
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 3 |
rev 4 |
2017-05-19 |
| snort |
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 |
rev 3 |
2017-05-18 |
| snort |
ET TROJAN Jaff Ransomware Checkin |
rev 1 |
2017-05-11 |
| snort |
ET TROJAN Jaff Ransomware Checkin M1 |
rev 2 |
2017-05-11 |
| snort |
ET TROJAN MSIL/NewHT Ransomware CnC Checkin |
rev 1 |
2017-05-05 |
| snort |
ET TROJAN MSIL/Runsome Ransomware CnC Checkin |
rev 1 |
2017-04-19 |
| snort |
ET TROJAN Win32/CryptFile2 / Revenge Ransomware Checkin M3 |
rev 2 |
2017-03-17 |
| snort |
ET TROJAN Spora Ransomware Checkin |
rev 2 |
2017-03-09 |
| snort |
ET TROJAN CryptoShield Ransomware Checkin |
rev 2 |
2017-02-16 |
| snort |
ET TROJAN Sage Ransomware Checkin |
rev 1 |
2017-01-25 |
| snort |
ET TROJAN Evil JS Ransomware |
rev 1 |
2017-01-18 |
| snort |
ET TROJAN MRCR1 Ransomware Checkin M1 |
rev 1 |
2017-01-03 |
| snort |
ET TROJAN MRCR1 Ransomware Checkin M2 |
rev 1 |
2017-01-03 |
| snort |
ET TROJAN Win32/Braincrypt Ransomware CnC Checkin |
rev 1 |
2016-12-20 |
| snort |
ET TROJAN MSIL/Alcatrez Locker Ransomware CnC Checkin |
rev 1 |
2016-11-14 |
| snort |
ET TROJAN CerberTear Ransomware CnC Checkin |
rev 1 |
2016-11-14 |
| snort |
ET TROJAN Win32/Jackpot Ransomware CnC Checkin |
rev 1 |
2016-10-27 |
| snort |
ET TROJAN Win32/CryptFile2 Ransomware Checkin |
rev 6 |
2016-10-24 |
| snort |
ET TROJAN Win32/CryptFile2 Ransomware Checkin M2 |
rev 1 |
2016-10-24 |
| snort |
ET TROJAN MSIL/HadesLocker Ransomware Checkin |
rev 1 |
2016-10-04 |
| snort |
ET TROJAN Locky Ransomware Renaming File via SMB |
rev 1 |
2016-09-01 |
| snort |
ET TROJAN Locky Ransomware Writing Instructions via SMB |
rev 1 |
2016-09-01 |
| snort |
ET TROJAN Ranscam Ransomware Contact Form |
rev 1 |
2016-07-14 |
| snort |
ET TROJAN Win32/Satana Ransomware Checkin |
rev 1 |
2016-06-30 |
| snort |
ET TROJAN JS/RAA Ransomware check-in |
rev 1 |
2016-06-15 |
| snort |
ET TROJAN BandarChor/CryptON Ransomware Checkin |
rev 2 |
2016-06-08 |
| snort |
ET TROJAN Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 ASCII |
rev 1 |
2016-05-25 |
| snort |
ET TROJAN Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 Unicode |
rev 1 |
2016-05-25 |
| snort |
ET TROJAN W32/Virus-Encoder Ransomware Checkin |
rev 1 |
2016-04-15 |
| snort |
ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 Unicode |
rev 3 |
2016-03-24 |
| snort |
ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 ASCII |
rev 1 |
2016-03-23 |
| snort |
ET TROJAN Win32/7ev3n Ransomware Process Checkin |
rev 1 |
2016-01-22 |
| snort |
ET TROJAN Win32/7ev3n Ransomware Initial Checkin |
rev 1 |
2016-01-22 |
| snort |
ET TROJAN FAKBEN Ransomware |
rev 2 |
2015-12-18 |
| snort |
ET TROJAN BandarChor Ransomware Checkin |
rev 5 |
2015-11-17 |
| snort |
ET TROJAN Possible Chimera Ransomware - Bitmessage Activity |
rev 1 |
2015-11-12 |
| snort |
ET TROJAN W32/DirCrypt.Ransomware CnC Checkin |
rev 5 |
2015-09-29 |
| snort |
ET TROJAN W32/Tobfy.Ransomware Invalid URI CnC Request |
rev 3 |
2014-09-19 |
| snort |
ET TROJAN W32/Tobfy.Ransomware CnC Request - status.php |
rev 3 |
2014-09-19 |
| snort |
ET WEB_CLIENT JS Browser Based Ransomware |
rev 1 |
2013-07-19 |
| snort |
ET TROJAN Lyposit Ransomware Checkin 1 |
rev 5 |
2013-05-20 |
| snort |
ET TROJAN Revoyem Ransomware Check-in |
rev 3 |
2013-04-06 |
| snort |
ET TROJAN Galock Ransomware Check-in |
rev 1 |
2013-03-22 |
| snort |
ET TROJAN Galock Ransomware Command |
rev 1 |
2013-03-22 |
| snort |
ET TROJAN Gimemo Ransomware Checkin |
rev 3 |
2013-02-25 |
| snort |
ET TROJAN Lyposit Ransomware Checkin 2 |
rev 1 |
2012-11-29 |
| sentinel |
Dev-0530 File Extension Rename |
Scheduled |
— |
| sentinel |
AV detections related to Europium actors |
Scheduled |
— |
| sentinel |
AV detections related to Hive Ransomware |
Scheduled |
— |
| sentinel |
AV detections related to Dev-0530 actors |
Scheduled |
— |