Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
Platforms
1
1
Products / Services
1
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
KQL Query from file: M365 Copilot Chat SafeLink Monitoring
This YARA rule detects the Kovter ransomware based on specific byte sequences found within the malware's executable. It looks for patterns related to remote connection functionalities, file enumeration, and payload decryption scripts, which are characteristic of Kovter's operation. The rule requires all identified string patterns to be present, along with a check for the MZ header (uint16(0) == 0x5A4D), indicating a Windows executable.
