Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This YARA rule detects the BadBlock ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for three distinct sets of byte sequences: one related to encrypting files, another for searching files, and a third for establishing remote connections. All three patterns must be present in a file, along with the MZ header (0x5A4D), for a detection to occur.
