Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This Yara rule detects the PoliceRecords ransomware. It identifies specific byte sequences related to file encryption, file discovery, desktop manipulation (likely for displaying a ransom note or changing wallpaper), and the dropping of a ransom note. The rule looks for these distinct patterns within executable files (identified by the 'MZ' header).
This YARA rule detects the WsIR ransomware based on specific byte sequences found in its code. The rule looks for patterns associated with file enumeration ($find_files), file encryption ($encrypt_files), and process execution ($exec_proc). The presence of all three patterns indicates the likely presence of the WsIR ransomware.
Yara rule that detects PoliceRecords ransomware.
Yara rule that detects WsIR ransomware.
This rule detects the Eternity ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines (including AES), and password handling. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The presence of all four string patterns ($find_files, $encrypt_files, $aes_encrypt, $encrypt_pass) strongly suggests the presence of Eternity ransomware.
This rule detects the EAF ransomware by identifying specific bytecode patterns associated with its file encryption, file finding, and file destruction functionalities. The rule looks for a combination of patterns related to encrypting files, locating files on the system, and destroying executable files, indicating the presence and activity of the EAF ransomware.
Yara rule that detects EAF ransomware.
Yara rule that detects Eternity ransomware.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
This rule detects the WaspLocker ransomware based on specific byte patterns associated with its functionality. The patterns indicate code responsible for finding files to encrypt, dropping auxiliary files, and creating ransomware notes.
Yara rule that detects GoodWill ransomware.
Yara rule that detects WaspLocker ransomware.
This YARA rule detects the Cincoo ransomware by identifying specific byte patterns associated with its file finding, file encryption, and ransom note dropping functionalities. The rule requires all three sets of patterns to be present in a file to trigger a detection, reducing false positives.
This Yara rule detects the FarAttack ransomware. It identifies specific byte patterns related to file searching, key creation, and file encryption routines commonly found in this ransomware variant. The rule looks for a combination of these patterns within a PE file to confirm the presence of FarAttack.
Yara rule that detects Cincoo ransomware.
Yara rule that detects FarAttack ransomware.
This rule detects the Venom ransomware by identifying specific bytecode patterns associated with its environment setup, file discovery, and encryption routines. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Nokoyawa ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating shares, finding files, and encrypting files, which are common behaviors of ransomware. The rule requires all three sets of patterns ($enum_shares, $find_files_p*, and $encrypt_files) to be present, along with the MZ header (uint16(0) == 0x5A4D), indicating an executable file.
Yara rule that detects Venom ransomware.
Yara rule that detects Nokoyawa ransomware.
This YARA rule detects the NB65 ransomware by identifying specific byte sequences associated with its file encryption, file discovery, and process enumeration functionalities. The rule looks for distinct patterns in the binary that indicate the presence of these malicious behaviors, which are characteristic of ransomware operations.
Page 209 of 232