Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Yara rule that detects Rook ransomware.
This rule detects the Apis ransomware by identifying specific bytecode patterns related to its core functionalities: finding files, encrypting files, and setting up its environment. The rule looks for a combination of these distinct bytecode sequences within a file, indicating the presence of the ransomware.
Yara rule that detects HotCoffee ransomware.
This YARA rule detects the Invert ransomware by identifying specific byte sequences related to its file encryption, file finding, and file listing functionalities. The rule looks for distinct patterns in the compiled bytecode that are characteristic of the Invert ransomware's operations.
This YARA rule detects the AvosLocker ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for patterns associated with file enumeration ($find_files), resource enumeration ($enum_resources), key import operations ($import_key), and file encryption routines ($encrypt_files). All four string patterns must be present in a file, and the file must start with the MZ header (0x5A4D) to be considered a match.
Yara rule that detects AvosLocker ransomware.
Yara rule that detects Jormungand ransomware.
Yara rule that detects TargetCompany ransomware.
Yara rule that detects Bam2021 ransomware.
Yara rule that detects Motocos ransomware.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Yara rule that detects TaRRaK ransomware.
This rule detects the Namaste ransomware by identifying specific bytecode patterns associated with its file discovery and encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of how Namaste ransomware locates files on a system and subsequently encrypts them. The `find_files_p*` strings target patterns related to file system enumeration, while the `encrypt_files_p*` strings target patterns involved in the encryption process itself. The rule also checks for the standard PE file magic number (0x5A4D) to ensure it's analyzing an executable.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
Yara rule that detects GhosTEncryptor ransomware.
Yara rule that detects Thanos ransomware.
Yara rule that detects WildFire ransomware.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
Yara rule that detects Henry ransomware.
Yara rule that detects Prometey ransomware.
Page 25 of 31