Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
This rule detects the NjRAT backdoor, a remote access Trojan (RAT). It identifies two main versions of the malware based on distinct byte patterns related to persistence mechanisms, command and control (connect, send, receive) functionalities, and system information gathering. The rule looks for specific sequences of bytecode instructions indicative of NjRAT's operational logic.
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Use of hostname to get information
Detects usage of the "systeminfo" command to retrieve information
This rule detects the ChinaZ trojan by identifying specific byte patterns associated with its functionalities. These functionalities include collecting system information, sending system information, parsing C2 commands, and performing DNS flood attacks. The rule contains distinct byte patterns for both 32-bit and 64-bit architectures of the malware.
Detects System Information Discovery commands
Detects the use of grep to discover specific files created by the GobRAT malware
Use of reg to get MachineGuid information
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
Yara rule that detects LumarStealer infostealer.
This YARA rule detects various components and behaviors associated with the BlackBasta ransomware. It identifies specific byte patterns related to file discovery, encryption routines (multiple versions), command prompt execution, LDAP connection attempts, dropping of ransom notes, and exclusion logic for files/volumes from encryption. The rule is designed to catch the ransomware executable itself based on these unique code signatures.
Yara rule that detects MedusaLocker ransomware.
Page 39 of 39