Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the Dridex banking Trojan by identifying specific byte patterns (API wrapper functions and file search snippets) commonly found in its executables. The rule requires the file to be a Windows executable (MZ header) and contain at least one of the defined API wrapper patterns and one of the file search patterns.
Yara rule that detects AwesomeScott ransomware.
Yara rule that detects Dridex trojan.
This rule detects the BananaCrypt ransomware based on specific byte patterns found in its 'encrypt_files' and 'find_files' functions. The rule looks for a combination of these patterns within a PE (Portable Executable) file, indicated by the 'MZ' header.
Yara rule that detects BananaCrypt ransomware.
This YARA rule detects the Termite ransomware by identifying specific byte sequences (patterns) associated with its file finding and encryption routines. The rule looks for distinct code blocks that are characteristic of how Termite ransomware operates to locate files and then encrypt them. The rule requires all parts of the 'find_files' patterns and all parts of the 'encrypt_files' patterns to be present, along with the MZ header (0x5A4D) indicating a Windows executable, to minimize false positives.
Yara rule that detects Termite ransomware.
This YARA rule detects the JuicyLemon ransomware by identifying specific byte sequences related to remote connections and file encryption routines. The rule looks for three distinct patterns: two associated with remote connection functionalities and one with the core logic for finding and encrypting files. All three patterns must be present, along with the standard Windows PE magic number (0x5A4D), to trigger a detection.
This YARA rule detects the KawaiiLocker ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences related to file searching, remote connections, and file encryption routines, indicating the presence and functionality of the KawaiiLocker ransomware.
Yara rule that detects JuicyLemon ransomware.
Yara rule that detects KawaiiLocker ransomware.
This rule detects the Domaiq Potentially Unwanted Application (PUA) by identifying a specific payload string and a combination of code patterns. These patterns include checks for NSIS (Nullsoft Scriptable Install System) integrity, UPX (Ultimate Packer for eXecutables) decompression and encryption, various dumping functions, and exception handling routines. The presence of these combined signatures indicates the likely presence of the Domaiq PUA.
This YARA rule detects the Alcatraz ransomware by identifying specific byte patterns associated with its file encryption routines and its communication with remote servers. The rule looks for three distinct byte sequences: one related to file encryption logic ($encrypt_files) and two others related to remote server communication ($remote_server and $remote_server_2). All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
Win32 PUA Domaiq
YARA
Yara rule that detects Domaiq potentially unwanted application.
Yara rule that detects Alcatraz ransomware.
This rule detects the dlMarlboro downloader based on specific byte patterns found within the executable. The patterns '$ping_apnic', '$download_bin_1', and '$download_bin_2' are indicative of the malware's code for network communication (pinging apnic) and downloading additional binaries.
This YARA rule detects the Marlboro ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with network communication (pinging APNIC, remote server connections) and file encryption routines. The presence of these combined patterns indicates the likely presence of the Marlboro ransomware.
Yara rule that detects dlMarlboro downloader.
Yara rule that detects Marlboro ransomware.
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
This YARA rule detects the ProjectHookPOS infostealer by identifying specific byte sequences (hex patterns) within executable files. The patterns correspond to functions related to calculating Luhn algorithm checksums (often used for credit card validation), reversing track data (common in POS malware for magnetic stripe data), checking validity, encoding and sending stolen data, and creating forms (potentially for data input or exfiltration). The rule requires all seven defined byte sequences to be present in a file that starts with the standard DOS executable magic number (0x5A4D) to trigger a detection.
Page 220 of 232