Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
38
35
14
13
7
Contributors
18
14
13
13
12
Categories
50
41
25
20
17
Platforms
112
8
4
2
1
Products / Services
27
24
17
7
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
4
1
IDS Protocols
5
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
This YARA rule detects the Nokoyawa ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating shares, finding files, and encrypting files, which are common behaviors of ransomware. The rule requires all three sets of patterns ($enum_shares, $find_files_p*, and $encrypt_files) to be present, along with the MZ header (uint16(0) == 0x5A4D), indicating an executable file.
This YARA rule detects the Koxic ransomware by identifying specific byte patterns related to its core functionalities. These patterns include code for enumerating network shares, finding files on the system, and encrypting files. The rule combines these patterns to increase confidence in detecting Koxic ransomware executables.
This rule detects the AntiWar ransomware based on specific byte patterns indicative of its file enumeration, share enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file (identified by the 'MZ' header).
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
This YARA rule detects the TechandStrat ransomware by identifying specific byte patterns related to its core functionalities. The rule looks for patterns associated with enumerating network shares, finding files on the system, and encrypting files. The presence of these combined patterns indicates the likely presence of the TechandStrat ransomware.
Yara rule that detects Zhen ransomware.
This YARA rule detects the Zeoticus ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating network shares, finding files, and encrypting files, which are core behaviors of ransomware. The rule requires all three sets of patterns to be present for a detection, reducing false positives.
This rule detects the Teslarvng ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and network share enumeration capabilities. The rule looks for distinct sequences of bytes that indicate the presence of the ransomware's core functionalities.
This Yara rule detects the Makop ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE executable (indicated by the 'MZ' header).
This Yara rule detects the DesuCrypt ransomware by identifying specific byte patterns associated with its file enumeration, encryption, and network share discovery functionalities. The rule looks for three distinct sets of byte sequences, all of which must be present in a file for a detection to occur. These patterns likely correspond to core functions within the ransomware's executable code.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
Yara rule that detects Dharma ransomware.
Page 6 of 6