Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
296 detections
Filters
Last updated
All Time
Detection languages
99
93
29
27
18
Contributors
58
47
44
26
18
Categories
89
82
78
61
59
Platforms
262
35
10
9
2
Products / Services
97
56
54
33
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
2
1
IDS Classtypes
11
7
5
3
1
IDS Protocols
20
7
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
Page 15 of 15