Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This rule detects the AntiWar ransomware based on specific byte patterns indicative of its file enumeration, share enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file (identified by the 'MZ' header).
Yara rule that detects Koxic ransomware.
Yara rule that detects AntiWar ransomware.
This YARA rule detects LockBit ransomware by identifying specific byte patterns (signatures) within executable files. It contains two main sets of conditions, likely corresponding to different versions or major functional blocks of the ransomware. The first set looks for patterns related to enumerating resources, finding files, and encrypting files. The second set looks for patterns related to checking blacklisted languages (anti-analysis/anti-geofencing), FNV1a hashing, creating network host traversal threads, decrypting configuration, and encrypting files. The rule requires the file to be a Windows executable (MZ header).
Yara rule that detects LockBit ransomware.
This rule detects the TimeTime ransomware by identifying specific bytecode patterns associated with its file enumeration, encryption, and renaming activities. The rule looks for distinct sequences of operations related to finding files, encrypting files, encrypting folders, and renaming files, which are characteristic behaviors of ransomware.
This YARA rule detects the MRAC ransomware by identifying specific byte patterns associated with its file encryption routines, key import mechanisms, and file discovery functions. The rule looks for a combination of these patterns within a file, ensuring a higher confidence in detection.
Yara rule that detects TimeTime ransomware.
Yara rule that detects MRAC ransomware.
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Yara rule that detects BlackCat ransomware.
Yara rule that detects ChiChi ransomware.
This YARA rule detects the HarpoonLocker ransomware by identifying specific bytecode patterns related to file encryption, file discovery, and boot modification. The rule looks for distinct sequences of opcodes and operands that are characteristic of how HarpoonLocker encrypts files, finds target files on a system, and attempts to alter boot configurations for persistence or impact.
Yara rule that detects HarpoonLocker ransomware.
Yara rule that detects Khonsari ransomware.
This rule detects the Redeemer ransomware by identifying specific byte patterns associated with its file discovery, encryption routines, and process modification activities. The rule looks for a combination of these patterns within a PE file to confirm the presence of Redeemer ransomware.
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
Yara rule that detects Redeemer ransomware.
Yara rule that detects Rook ransomware.
This Yara rule detects the Janelle ransomware by identifying specific bytecode patterns associated with its setup environment, file finding mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Janelle ransomware initializes itself, locates target files, and performs encryption.
Yara rule that detects Janelle ransomware.
Page 34 of 50