Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Yara rule that detects WormLocker ransomware.
Yara rule that detects Networm ransomware.
Yara rule that detects DarkSide ransomware.
Yara rule that detects Vovalex ransomware.
Yara rule that detects WinWord64 ransomware.
This YARA rule detects the Badbeeteam ransomware by identifying specific byte patterns associated with its file finding, file encryption, and HTA file dropping functionalities. The rule looks for distinct sequences of bytes in the executable to identify the presence of this particular ransomware.
Yara rule that detects Thanatos ransomware.
Yara rule that detects Avaddon ransomware.
Yara rule that detects KawaiiLocker ransomware.
Win32 PUA Domaiq
YARA
Yara rule that detects Domaiq potentially unwanted application.
Yara rule that detects Alcatraz ransomware.
Yara rule that detects Marlboro ransomware.
This YARA rule detects the FLKR ransomware based on specific byte patterns found within its executable code. The rule uses three distinct byte sequences ($search_and_encrypt_p1, $search_and_encrypt_p2, $search_and_encrypt_p3) that are characteristic of the ransomware's search and encryption routines. The condition `uint16(0) == 0x5A4D` ensures that the scanned file is a valid Windows executable (MZ header), and `all of ($search_and_encrypt_p*)` requires all three byte patterns to be present for a match, reducing false positives.
This rule detects the Reveton ransomware based on specific byte patterns found within the executable. The patterns indicate functionalities related to HTTP and raw socket connections, as well as file search operations, which are characteristic behaviors of this ransomware.
This YARA rule detects the TBLocker ransomware by identifying specific byte patterns within the executable. It looks for distinct sequences of bytes associated with the ransomware's main functions, including those responsible for searching and encrypting files. The rule requires all parts of the main ransomware function patterns, along with the file search and encryption patterns, to be present in a PE (Portable Executable) file (indicated by `uint16(0) == 0x5A4D`) to trigger a detection.
This rule detects the Win32_Virus_Awfull malware by identifying a specific byte pattern within the Portable Executable (PE) file's entry point. The rule checks for the presence of the 'MZ' magic bytes (0x5A4D) at the beginning of the file, confirming it's a PE file, and then scans for a unique sequence of bytes ($awfull_body) at the entry point, which is characteristic of the Awfull virus.
Yara rule that detects CVE-2020-0601 exploit.
Yara rule that detects MultigrainPOS infostealer.
Yara rule that detects KillDisk ransomware.
Yara rule that detects Archiveus ransomware.
Yara rule that detects BandarChor ransomware.
Page 78 of 80