Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This YARA rule detects the Satan ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, searching for processes, encrypting files, and searching for files in specific folders. The rule combines these patterns to increase confidence in detection.
This YARA rule detects the TorrentLocker ransomware by identifying specific byte sequences (signatures) associated with its executable code. These signatures include patterns related to its entry point, functions for contacting command and control servers, retrieving server data, removing shadow copies to prevent recovery, and finding files for encryption. The rule requires a combination of these patterns to trigger, ensuring a higher confidence in detection.
This YARA rule detects the Velso ransomware by identifying specific byte sequences (patterns) associated with its file enumeration, resource enumeration, and file encryption routines. The rule looks for distinct code blocks within the malware that are characteristic of how Velso operates to find files, enumerate system resources, and encrypt data.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
This rule detects the Ako ransomware by identifying specific byte patterns (YARA signatures) associated with its file encryption routines, including those targeting local files and network shares. The rule looks for distinct code sequences related to file enumeration and encryption activities, indicating the presence and execution of the Ako ransomware.
Yara rule that detects ASN1Encoder ransomware.
Yara rule that detects Afrodita ransomware.
Yara rule that detects Armage ransomware.
Yara rule that detects BitCrypt ransomware.
Yara rule that detects Blitzkrieg ransomware.
Yara rule that detects Clop ransomware.
Yara rule that detects Crypren ransomware.
Yara rule that detects CryptoFortress ransomware.
Yara rule that detects Crysis ransomware.
Yara rule that detects Cuba ransomware.
Yara rule that detects DMALocker ransomware.
Yara rule that detects Defray ransomware.
Yara rule that detects DesuCrypt ransomware.
Page 29 of 31