Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This Yara rule detects the CyberVolk ransomware by identifying specific byte patterns within its 'manage_gui', 'find_files', and 'encrypt_files' functions. The rule looks for two distinct versions of the 'find_files' and 'encrypt_files' functions, indicating variations in the ransomware's implementation. The presence of these patterns suggests the file is a CyberVolk ransomware executable.
Yara rule that detects CyberVolk ransomware.
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
This rule detects when the 'RstrtMgr.dll' (Restart Manager) library is loaded by a process that is not part of the common legitimate Windows processes or typical software installation paths. Adversaries, particularly ransomware and wiper malware, have been observed using this DLL to terminate processes that might interfere with their operations, such as file encryption or data destruction. This can include killing processes that lock files, preventing encryption, or for anti-analysis purposes.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Yara rule that detects Cicada3301 ransomware.
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
Detects suspicious modifications to BitLocker-related registry keys using the `reg.exe` utility. Adversaries may modify these keys to enable or disable BitLocker, potentially as a precursor to data encryption for impact (ransomware) or to facilitate data exfiltration by disabling encryption.
Detects file renames where the target filename uses an uncommon double extension. This behavior is often associated with ransomware activity, where files are encrypted and then renamed with a custom extension, such as ".jpg.crypted" or ".docx.locky". The rule specifically looks for common document and image file extensions followed by another extension, while filtering out known legitimate backup or temporary file extensions.
Detects specific command-line arguments used by the Conti ransomware during its execution phase. The rule looks for a combination of arguments including '-m ', '-net ', '-size ', '-nomutex ', and '-p \\', which are characteristic of Conti's encryption process. This pattern indicates the ransomware is likely attempting to encrypt files on the system or network shares.
Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.
Detects the execution of the 'gpg.exe' utility when its filename has been changed. Adversaries, particularly ransomware and loaders, often rename legitimate tools like GnuPG to evade detection while using them for encryption or decryption operations.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.
Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.
This YARA rule detects the Albabat ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for patterns related to file encryption, dropping a ransom note, changing the desktop wallpaper, and finding files to encrypt. The presence of these combined patterns indicates the likely presence of the Albabat ransomware.
Page 31 of 50