Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Yara rule that detects Encoded01 ransomware.
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
This rule detects the DST ransomware by identifying specific byte patterns associated with its core functionalities: encrypting files, finding files to encrypt, and killing processes. The rule looks for distinct sequences of assembly instructions (byte patterns) that are characteristic of how DST ransomware operates. Specifically, it requires all three sets of patterns related to file encryption, file discovery, and process termination to be present within a file to trigger a detection. The rule also checks for the standard Windows executable MZ header (0x5A4D) to ensure it's analyzing a valid executable.
Yara rule that detects TimeCrypt ransomware.
Yara rule that detects DST ransomware.
This YARA rule detects the HotCoffee ransomware. It identifies specific byte patterns related to the ransomware's functionality, including enumerating drives, finding files, encrypting files, and dropping a ransom note. The rule looks for a combination of these patterns to ensure high confidence in detection.
Yara rule that detects Apis ransomware.
Yara rule that detects HotCoffee ransomware.
This YARA rule detects the Invert ransomware by identifying specific byte sequences related to its file encryption, file finding, and file listing functionalities. The rule looks for distinct patterns in the compiled bytecode that are characteristic of the Invert ransomware's operations.
Yara rule that detects Invert ransomware.
Yara rule that detects Sanwai ransomware.
This rule detects the Solaso ransomware by identifying specific byte patterns related to its file finding and encryption routines. The rule looks for distinct sequences of bytes within the executable, indicating the presence of Solaso ransomware.
This rule detects the Wintenzz ransomware by identifying specific byte patterns related to its file finding, encryption, and ransom note dropping functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects Solaso ransomware.
Yara rule that detects Wintenzz ransomware.
This YARA rule detects the AvosLocker ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for patterns associated with file enumeration ($find_files), resource enumeration ($enum_resources), key import operations ($import_key), and file encryption routines ($encrypt_files). All four string patterns must be present in a file, and the file must start with the MZ header (0x5A4D) to be considered a match.
This YARA rule detects the Jormungand ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include dropping a ransom note, encrypting files using AES and RSA algorithms, finding files to encrypt, and establishing remote connections. The rule specifically looks for these patterns within executable files (indicated by `uint16(0) == 0x5A4D` for MZ header).
Yara rule that detects AvosLocker ransomware.
Yara rule that detects Jormungand ransomware.
This rule detects the Hog ransomware by identifying specific bytecode patterns associated with key generation, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The patterns '$generate_key', '$find_files', and '$encrypt_files_p1' and '$encrypt_files_p2' must all be present for a detection.
Yara rule that detects ChupaCabra ransomware.
Page 35 of 50