Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
4
1
Categories
4
4
1
1
1
Platforms
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
This rule detects the Moisha ransomware by identifying specific bytecode patterns related to file enumeration, private key importation, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Moisha's operational methodology.
This rule detects the DarkSide ransomware by identifying specific byte patterns (YARA signatures) associated with its functionality. The rule looks for combinations of code that suggest file enumeration, drive enumeration, privilege escalation, and network share enumeration, which are common behaviors of DarkSide ransomware. Specifically, it checks for two main sets of conditions: one involving finding files, enumerating drives, and escalating privileges, and another involving finding files and enumerating network shares. The rule also verifies that the file is a Windows executable (MZ header).
This YARA rule detects the Avaddon ransomware by identifying specific byte sequences related to its file finding, encryption, resource enumeration, and remote connection functionalities. The rule looks for a combination of these distinct patterns within a file, indicating the presence of Avaddon ransomware.
Yara rule that detects Avaddon ransomware.