Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
390 detections
Filters
Last updated
All Time
Detection languages
150
87
71
26
16
Contributors
58
55
51
39
39
Categories
189
94
84
82
59
Platforms
185
68
60
30
27
Products / Services
73
57
50
43
31
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
IDS Protocols
4
This rule detects the Linux_Trojan_AcidRain malware by identifying specific byte patterns associated with its destructive capabilities. The rule looks for functions related to destroying files using ioctls, overwriting files, and redundant reboot attempts, indicating the presence of the AcidRain wiper malware.
Yara rule that detects AcidRain trojan.
This YARA rule detects the BiBiWiper trojan by identifying specific byte sequences associated with its shadow copy deletion and file destruction functionalities. The rule looks for two distinct patterns, '$delete_shadow_copies_p*' and '$destroy_files_p*', which are indicative of the malware's destructive behavior. The presence of both sets of patterns within a file, combined with the MZ header (0x5A4D), triggers the detection.
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Might be used by ransomwares during the attack (seen by NotPetya and others).
This rule detects the CaddyWiper trojan, a destructive data wiper, by identifying specific byte patterns within executable files. The patterns correspond to functions involved in destroying data if the system is not a controller, erasing drive data, and recursively erasing drives.
Yara rule that detects CaddyWiper trojan.
This YARA rule detects the IsaacWiper trojan by identifying specific byte patterns related to its functionality. The rule looks for two distinct code sections: one responsible for enumerating physical drives and another for corrupting drive data. The presence of both patterns indicates the likely presence of the IsaacWiper malware, which is known for its destructive disk wiping capabilities.
Yara rule that detects HermeticWiper trojan.
Yara rule that detects KillDisk ransomware.
Page 19 of 19