Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This Yara rule detects the PoliceRecords ransomware. It identifies specific byte sequences related to file encryption, file discovery, desktop manipulation (likely for displaying a ransom note or changing wallpaper), and the dropping of a ransom note. The rule looks for these distinct patterns within executable files (identified by the 'MZ' header).
Yara rule that detects PoliceRecords ransomware.
Yara rule that detects WsIR ransomware.
This rule detects the EAF ransomware by identifying specific bytecode patterns associated with its file encryption, file finding, and file destruction functionalities. The rule looks for a combination of patterns related to encrypting files, locating files on the system, and destroying executable files, indicating the presence and activity of the EAF ransomware.
Yara rule that detects EAF ransomware.
Yara rule that detects Eternity ransomware.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
Yara rule that detects GoodWill ransomware.
Yara rule that detects WaspLocker ransomware.
Yara rule that detects Cincoo ransomware.
Yara rule that detects FarAttack ransomware.
This YARA rule detects the Nokoyawa ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating shares, finding files, and encrypting files, which are common behaviors of ransomware. The rule requires all three sets of patterns ($enum_shares, $find_files_p*, and $encrypt_files) to be present, along with the MZ header (uint16(0) == 0x5A4D), indicating an executable file.
Yara rule that detects Venom ransomware.
Yara rule that detects Nokoyawa ransomware.
Yara rule that detects NB65 ransomware.
Yara rule that detects Pandora ransomware.
This YARA rule detects the Monalisa ransomware by identifying specific byte sequences (strings) associated with its core functionalities. These functionalities include finding files for encryption, writing to process memory (potentially for injection or other malicious operations), generating encryption keys, and encrypting files. The rule also checks for the standard Windows PE header (MZ) to ensure it's analyzing an executable.
This YARA rule detects the HermeticRansom ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to dropping a ransom note, encrypting files, and finding files to encrypt. The presence of these combined patterns indicates the presence of the HermeticRansom malware.
Yara rule that detects Monalisa ransomware.
Yara rule that detects HermeticRansom ransomware.
This YARA rule detects the Koxic ransomware by identifying specific byte patterns related to its core functionalities. These patterns include code for enumerating network shares, finding files on the system, and encrypting files. The rule combines these patterns to increase confidence in detecting Koxic ransomware executables.
Page 33 of 50