Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the AnteFrigus ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files on the system, encrypting files, and establishing remote connections, likely for command and control or data exfiltration. The rule also checks for the standard Windows executable 'MZ' header.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
Yara rule that detects AnteFrigus ransomware.
Yara rule that detects Hentai Oniichan ransomware.
This YARA rule detects the FuxSocy ransomware by identifying specific byte patterns associated with its file encryption and file discovery functionalities. The rule targets Windows executable files (indicated by the 'MZ' header) and looks for distinct code sequences that perform actions typical of ransomware, such as locating files on the system and subsequently encrypting them.
Yara rule that detects FuxSocy ransomware.
This Yara rule detects the Plague17 ransomware by identifying specific byte sequences associated with its file finding, file encryption, and remote connection functionalities. The rule looks for distinct patterns in the malware's code related to these core ransomware behaviors.
Yara rule that detects Plague17 ransomware.
This YARA rule detects the InfoDot ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes ($find_files_p1, $find_files_p2, $find_files_p3, $find_files_p4) that are indicative of the ransomware's file enumeration logic, and another sequence ($encrypt_files) that signifies its encryption functionality. The rule requires all file finding patterns and the encryption pattern to be present within a Portable Executable (MZ header) to trigger, ensuring a high confidence detection of the InfoDot ransomware.
Yara rule that detects InfoDot ransomware.
This rule detects the ShadowCryptor ransomware based on specific byte patterns indicative of its file finding, file encryption, and antivirus termination routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
This YARA rule detects the WinWord64 ransomware by identifying specific byte patterns related to remote connections, file encryption routines, and file discovery mechanisms. The rule looks for a combination of these patterns within a PE file (indicated by 'uint16(0) == 0x5A4D' for 'MZ' header). The 'remote_connection_p*' strings suggest network communication capabilities, while 'encrypt_files_p*' strings indicate file encryption functionality, and 'find_files' points to file enumeration or discovery.
Yara rule that detects ShadowCryptor ransomware.
Yara rule that detects WinWord64 ransomware.
This Yara rule detects the Babuk ransomware by identifying specific byte sequences related to its file enumeration, file encryption, and resource enumeration functionalities. The rule looks for distinct patterns in the malware's code that are characteristic of Babuk's operations.
This YARA rule detects the 'Major' ransomware by identifying specific byte patterns related to file enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a Windows executable (MZ header).
Yara rule that detects Babuk ransomware.
Yara rule that detects Major ransomware.
This YARA rule detects the Conti ransomware by identifying specific byte patterns ($find_files, $encrypt_files_p1, $encrypt_files_p2) within executable files. These patterns are associated with the ransomware's file enumeration and encryption routines. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, aiming to minimize false positives.
This rule detects the Teslarvng ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and network share enumeration capabilities. The rule looks for distinct sequences of bytes that indicate the presence of the ransomware's core functionalities.
Yara rule that detects Conti ransomware.
Page 217 of 232