Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Yara rule that detects InfoDot ransomware.
This rule detects the ShadowCryptor ransomware based on specific byte patterns indicative of its file finding, file encryption, and antivirus termination routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
Yara rule that detects WinWord64 ransomware.
Yara rule that detects Major ransomware.
This rule detects the Teslarvng ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and network share enumeration capabilities. The rule looks for distinct sequences of bytes that indicate the presence of the ransomware's core functionalities.
Yara rule that detects Teslarvng ransomware.
Yara rule that detects Oni ransomware.
Yara rule that detects WastedLocker ransomware.
This YARA rule detects the Ransomexx ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file to confirm the presence of Ransomexx.
Yara rule that detects GusCrypter ransomware.
Yara rule that detects Ransomexx ransomware.
Yara rule that detects Badbeeteam ransomware.
Yara rule that detects BlackMoon ransomware.
Yara rule that detects HakunaMatata ransomware.
This YARA rule detects the Dragon ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with remote connections, file discovery, file encryption routines, and a unique characteristic of skipping Hong Kong, China, and Taiwan in its operations. The presence of these combined patterns indicates the likely presence of the Dragon ransomware.
This Yara rule detects the Makop ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE executable (indicated by the 'MZ' header).
Yara rule that detects Dragon ransomware.
Yara rule that detects Makop ransomware.
This YARA rule detects the Lolkek ransomware by identifying specific byte sequences associated with its file encryption routines, volume discovery, and file discovery mechanisms. The rule looks for patterns related to encrypting files, finding logical volumes, and enumerating files, which are characteristic behaviors of ransomware.
Yara rule that detects Outsider ransomware.
Yara rule that detects Saturn ransomware.
Page 27 of 31