Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Yara rule that detects RedAlert ransomware.
This YARA rule detects the Acepy ransomware by identifying specific byte patterns associated with its core functionalities: finding files to encrypt, performing the encryption process, and dropping a ransom note. The rule requires all three patterns to be present within a Windows executable file (indicated by the MZ header) to trigger a detection.
Yara rule that detects Acepy ransomware.
Yara rule that detects BlueLocker ransomware.
Yara rule that detects WsIR ransomware.
Yara rule that detects Cincoo ransomware.
This YARA rule detects the Nokoyawa ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating shares, finding files, and encrypting files, which are common behaviors of ransomware. The rule requires all three sets of patterns ($enum_shares, $find_files_p*, and $encrypt_files) to be present, along with the MZ header (uint16(0) == 0x5A4D), indicating an executable file.
Yara rule that detects Nokoyawa ransomware.
This YARA rule detects the NB65 ransomware by identifying specific byte sequences associated with its file encryption, file discovery, and process enumeration functionalities. The rule looks for distinct patterns in the binary that indicate the presence of these malicious behaviors, which are characteristic of ransomware operations.
Yara rule that detects NB65 ransomware.
This YARA rule detects the Monalisa ransomware by identifying specific byte sequences (strings) associated with its core functionalities. These functionalities include finding files for encryption, writing to process memory (potentially for injection or other malicious operations), generating encryption keys, and encrypting files. The rule also checks for the standard Windows PE header (MZ) to ensure it's analyzing an executable.
Yara rule that detects HermeticRansom ransomware.
This YARA rule detects the Koxic ransomware by identifying specific byte patterns related to its core functionalities. These patterns include code for enumerating network shares, finding files on the system, and encrypting files. The rule combines these patterns to increase confidence in detecting Koxic ransomware executables.
This rule detects the AntiWar ransomware based on specific byte patterns indicative of its file enumeration, share enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file (identified by the 'MZ' header).
Yara rule that detects Koxic ransomware.
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Yara rule that detects BlackCat ransomware.
Yara rule that detects ChiChi ransomware.
This rule detects the Redeemer ransomware by identifying specific byte patterns associated with its file discovery, encryption routines, and process modification activities. The rule looks for a combination of these patterns within a PE file to confirm the presence of Redeemer ransomware.
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
Yara rule that detects Redeemer ransomware.
Page 24 of 31