Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
14
5
3
1
Contributors
11
5
3
2
1
Categories
11
8
7
2
2
Platforms
23
2
2
Products / Services
8
7
3
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the execution of a renamed MegaSync.exe, which has been observed in use by ransomware families such as Nefilim, Sodinokibi (REvil), Pysa, and Conti. The rule specifically looks for processes where the original filename metadata is 'megasync.exe' but the executed image path does not end with '\megasync.exe', indicating a renaming event.
This YARA rule detects the Conti ransomware by identifying specific byte patterns ($find_files, $encrypt_files_p1, $encrypt_files_p2) within executable files. These patterns are associated with the ransomware's file enumeration and encryption routines. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, aiming to minimize false positives.
Page 2 of 2