Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
224 detections
Filters
Last updated
All Time
Detection languages
102
43
27
17
17
Contributors
65
29
21
20
12
Categories
124
120
35
28
20
Platforms
177
40
22
5
5
Products / Services
47
36
24
14
12
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
IDS Classtypes
1
1
1
IDS Protocols
2
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
Yara rule that detects Redeemer ransomware.
Yara rule that detects Rook ransomware.
Yara rule that detects Oni ransomware.
This YARA rule detects the Horsedeal ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for code segments responsible for enumerating system resources, searching for processes, discovering files on the system, and performing file encryption. The presence of all these patterns, along with a valid Windows executable header, indicates the presence of the Horsedeal ransomware.
This YARA rule detects the Matsnu ransomware based on specific byte sequences indicative of its functionality. The rule looks for patterns related to remote connections, file encryption routines, and file enumeration, suggesting the presence of the Matsnu ransomware.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This Yara rule detects the Ransoc ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include scanning for services, establishing remote connections, finding files to encrypt, and performing file encryption. The rule looks for distinct sequences of assembly instructions that are characteristic of Ransoc's operational methods.
This YARA rule detects the Satan ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, searching for processes, encrypting files, and searching for files in specific folders. The rule combines these patterns to increase confidence in detection.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
Yara rule that detects Armage ransomware.
Yara rule that detects District ransomware.
Yara rule that detects MedusaLocker ransomware.
Yara rule that detects Satan ransomware.
Page 11 of 11