Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.
Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse
Detects service installation in suspicious folder appdata
Detects service installation with suspicious folder patterns
This rule detects the WhiteBlackCrypt ransomware by identifying specific byte patterns associated with its file finding, file encryption, and service registration functionalities. The rule looks for a combination of these patterns within a PE file, indicated by the 'MZ' header.
Yara rule that detects WhiteBlackCrypt ransomware.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
Yara rule that detects HakunaMatata ransomware.
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
This YARA rule detects the HDDCryptor ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include deploying components, gathering share information, encrypting disks, creating a DiskCryptor service, extracting DiskCryptor from resources, encrypting files, and initiating a system reboot. The rule looks for combinations of these patterns to ensure high confidence in detection.
Yara rule that detects MultigrainPOS infostealer.
Yara rule that detects HDDCryptor ransomware.
Page 37 of 37