Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Yara rule that detects Hog ransomware.
This rule detects the McBurglar ransomware by identifying specific bytecode patterns related to its setup, file enumeration, salt generation for encryption, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of McBurglar's operations.
This rule detects the presence of TargetCompany ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include encrypting files, generating encryption keys, finding files to encrypt, and establishing remote connections, which are all characteristic behaviors of ransomware.
Yara rule that detects McBurglar ransomware.
Yara rule that detects TargetCompany ransomware.
This YARA rule detects the Bam2021 ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include enumerating shares, finding files for encryption, generating encryption keys, performing file encryption, and establishing remote connections, likely for command and control or data exfiltration.
This YARA rule detects the Motocos ransomware by identifying specific byte patterns associated with its key generation, file finding, and file encryption routines. The rule looks for three distinct sequences of bytes, indicating the presence of the ransomware's core functionalities within a Windows executable.
Yara rule that detects Bam2021 ransomware.
Yara rule that detects Motocos ransomware.
This rule detects the Ghostbin ransomware by identifying specific bytecode patterns related to environment setup, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the magic number 0x5A4D at the beginning of the file.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Yara rule that detects Ghostbin ransomware.
Yara rule that detects TaRRaK ransomware.
This YARA rule detects the Cring ransomware based on specific bytecode patterns. The rule looks for distinct sequences of bytes related to file finding and encryption operations, which are characteristic of the Cring ransomware family. The presence of these patterns indicates that a file is likely a Cring ransomware executable.
This YARA rule detects the Fantom ransomware by identifying specific byte sequences associated with its file encryption routines, lock file creation, directory locking mechanisms, and key sending functions. The rule looks for a combination of these patterns within a file to confirm the presence of Fantom ransomware.
This rule detects the GhosTEncryptor ransomware by identifying specific byte patterns related to its folder enumeration and encryption routines. The rule looks for a combination of patterns that indicate the ransomware's logic for enumerating folders and encrypting files within those folders, as well as deep search functionalities. The presence of these specific byte sequences, along with the MZ header, strongly suggests the presence of GhosTEncryptor.
This rule detects the Namaste ransomware by identifying specific bytecode patterns associated with its file discovery and encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of how Namaste ransomware locates files on a system and subsequently encrypts them. The `find_files_p*` strings target patterns related to file system enumeration, while the `encrypt_files_p*` strings target patterns involved in the encryption process itself. The rule also checks for the standard PE file magic number (0x5A4D) to ensure it's analyzing an executable.
This Yara rule detects the Povlsomware ransomware. It identifies specific bytecode patterns associated with the ransomware's setup, file discovery, and encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file (indicated by the 'MZ' header).
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
Page 36 of 50