Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
This YARA rule detects the Gomer ransomware by identifying specific byte patterns associated with its file enumeration, file finding, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Gomer ransomware operates on a Windows system, specifically in functions related to enumerating drives, finding files, and encrypting them.
Yara rule that detects Gomer ransomware.
Yara rule that detects Sifreli ransomware.
This YARA rule detects the Balaclava ransomware based on specific byte patterns found in its executable. The patterns are associated with functions responsible for finding files, encrypting files, and identifying volumes, which are core functionalities of ransomware.
This YARA rule detects the Horsedeal ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for code segments responsible for enumerating system resources, searching for processes, discovering files on the system, and performing file encryption. The presence of all these patterns, along with a valid Windows executable header, indicates the presence of the Horsedeal ransomware.
Yara rule that detects Balaclava ransomware.
Yara rule that detects AwesomeScott ransomware.
Yara rule that detects Dridex trojan.
Yara rule that detects BananaCrypt ransomware.
Yara rule that detects Termite ransomware.
This YARA rule detects the ASN1Encoder ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of patterns indicative of ransomware behavior, including functions for finding files, encrypting them, and establishing remote connections, all within a Windows executable (MZ header check).
This YARA rule detects the BadBlock ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for three distinct sets of byte sequences: one related to encrypting files, another for searching files, and a third for establishing remote connections. All three patterns must be present in a file, along with the MZ header (0x5A4D), for a detection to occur.
This YARA rule detects the CryptoFortress ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The rule looks for code sections related to enumerating drives and shared resources, finding files, encrypting files, reading configuration files, and specific encryption routines. The conditions ensure that the detected patterns are present in a PE file (MZ header) and that either a combination of configuration/encryption routines or drive/file enumeration and encryption functions are found.
This YARA rule detects the Crysis ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code related to remote connections, file enumeration, resource enumeration, and file encryption, which are characteristic behaviors of ransomware.
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This YARA rule detects the DMR ransomware by identifying specific byte patterns associated with its file discovery and encryption routines. The rule looks for distinct code segments that are characteristic of how this ransomware locates files on a system and subsequently encrypts them.
This Yara rule detects the DesuCrypt ransomware by identifying specific byte patterns associated with its file enumeration, encryption, and network share discovery functionalities. The rule looks for three distinct sets of byte sequences, all of which must be present in a file for a detection to occur. These patterns likely correspond to core functions within the ransomware's executable code.
This rule detects the District ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential District ransomware samples.
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
This YARA rule detects the HDMR ransomware by identifying specific byte patterns associated with its file finding, encryption, and backup targeting functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the HDMR ransomware's code for locating files, encrypting them, and specifically targeting Microsoft Exchange backups.
This YARA rule detects the Jamper ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential Jamper ransomware samples.
Page 28 of 31