Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
246 detections
Filters
Last updated
All Time
Detection languages
143
77
16
5
3
Contributors
140
36
26
11
5
Categories
194
131
43
33
23
Platforms
232
5
4
3
1
Products / Services
60
9
7
5
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
This YARA rule detects the Retis ransomware by identifying specific byte sequences related to its file searching, drive enumeration, and file encryption functionalities. The rule looks for three distinct patterns: one associated with searching files, another with enumerating drives, and a third with the encryption process. All three patterns must be present for a detection to occur, along with the standard PE file magic number (MZ header).
This YARA rule detects the Pacman ransomware by identifying specific byte code patterns within executable files. The rule looks for distinct sequences of bytes associated with the ransomware's file encryption and file finding functionalities, indicating the presence of Pacman ransomware.
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
This rule detects the ZeroLocker ransomware by identifying specific bytecode patterns within executable files. The rule looks for three distinct encryption routine patterns ($encrypt_routine_1, $encrypt_routine_2, and $encrypt_routine_3) in files that start with the 'MZ' header (indicating a Windows executable). The presence of all three patterns strongly suggests the file is ZeroLocker ransomware.
This YARA rule detects the CobraLocker ransomware by identifying specific bytecode patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns in the `encrypt_files` and `find_files` sections, along with checking for the MZ header (uint16(0) == 0x5A4D) to ensure it's an executable.
This rule detects the Networm ransomware by identifying specific byte patterns associated with its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This rule detects the WhiteBlackCrypt ransomware by identifying specific byte patterns associated with its file finding, file encryption, and service registration functionalities. The rule looks for a combination of these patterns within a PE file, indicated by the 'MZ' header.
This YARA rule detects the Henry ransomware by identifying specific byte sequences related to its core functionalities. These functionalities include finding files for encryption, performing the encryption process, setting up its operational environment, and initializing its components. The rule requires all four sets of byte patterns to be present in a file, along with the MZ header, to minimize false positives.
This YARA rule detects the Sarbloh ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for distinct sequences of bytes in the executable, indicating the presence of Sarbloh's core functionalities for locating and encrypting files.
This rule detects the Curator ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file, indicating the presence of the ransomware.
This YARA rule detects the RegretLocker ransomware by identifying specific byte sequences related to its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for patterns across multiple parts of the malware's code, indicating its presence within a binary.
This YARA rule detects the Knot ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes that are characteristic of how Knot ransomware encrypts files, finds target files on a system, and establishes remote connections, indicating the presence and activity of this specific malware.
This YARA rule detects the Zeoticus ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating network shares, finding files, and encrypting files, which are core behaviors of ransomware. The rule requires all three sets of patterns to be present for a detection, reducing false positives.
This YARA rule detects the Vovalex ransomware by identifying specific byte patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns related to how the ransomware encrypts files and how it finds files on the system, ensuring a high confidence detection of the Vovalex malware.
This YARA rule detects the AnteFrigus ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files on the system, encrypting files, and establishing remote connections, likely for command and control or data exfiltration. The rule also checks for the standard Windows executable 'MZ' header.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
This Yara rule detects the Plague17 ransomware by identifying specific byte sequences associated with its file finding, file encryption, and remote connection functionalities. The rule looks for distinct patterns in the malware's code related to these core ransomware behaviors.
This YARA rule detects the InfoDot ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes ($find_files_p1, $find_files_p2, $find_files_p3, $find_files_p4) that are indicative of the ransomware's file enumeration logic, and another sequence ($encrypt_files) that signifies its encryption functionality. The rule requires all file finding patterns and the encryption pattern to be present within a Portable Executable (MZ header) to trigger, ensuring a high confidence detection of the InfoDot ransomware.
This rule detects the ShadowCryptor ransomware based on specific byte patterns indicative of its file finding, file encryption, and antivirus termination routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
This rule detects the Oni ransomware based on specific byte patterns ($find_files, $encrypt_files, $search_processes) found within executable files. The patterns indicate functionality related to searching for files, encrypting them, and potentially enumerating processes, which are characteristic behaviors of ransomware.
Page 8 of 12