Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This YARA rule detects the CobraLocker ransomware by identifying specific bytecode patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns in the `encrypt_files` and `find_files` sections, along with checking for the MZ header (uint16(0) == 0x5A4D) to ensure it's an executable.
Yara rule that detects Cring ransomware.
Yara rule that detects Dusk ransomware.
Yara rule that detects Fantom ransomware.
Yara rule that detects GhosTEncryptor ransomware.
Yara rule that detects Namaste ransomware.
Yara rule that detects Oct ransomware.
Yara rule that detects Pacman ransomware.
Yara rule that detects Povlsomware ransomware.
Yara rule that detects Retis ransomware.
Yara rule that detects Thanos ransomware.
Yara rule that detects WildFire ransomware.
Yara rule that detects WormLocker ransomware.
Yara rule that detects ZeroLocker ransomware.
Yara rule that detects CobraLocker ransomware.
Yara rule that detects Networm ransomware.
Yara rule that detects WhiteBlackCrypt ransomware.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
Yara rule that detects Henry ransomware.
Yara rule that detects HowAreYou ransomware.
This YARA rule detects the Prometey ransomware based on specific byte patterns found in its executable code. The patterns indicate functionality related to remote connections, file discovery, and file encryption, which are characteristic behaviors of ransomware.
Page 37 of 50