Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
Yara rule that detects Prometey ransomware.
Yara rule that detects Sarbloh ransomware.
This rule detects the DarkSide ransomware by identifying specific byte patterns (YARA signatures) associated with its functionality. The rule looks for combinations of code that suggest file enumeration, drive enumeration, privilege escalation, and network share enumeration, which are common behaviors of DarkSide ransomware. Specifically, it checks for two main sets of conditions: one involving finding files, enumerating drives, and escalating privileges, and another involving finding files and enumerating network shares. The rule also verifies that the file is a Windows executable (MZ header).
This YARA rule detects the TechandStrat ransomware by identifying specific byte patterns related to its core functionalities. The rule looks for patterns associated with enumerating network shares, finding files on the system, and encrypting files. The presence of these combined patterns indicates the likely presence of the TechandStrat ransomware.
Yara rule that detects DarkSide ransomware.
Yara rule that detects TechandStrat ransomware.
This rule detects the RedRoman ransomware based on specific byte patterns found in its executable code. The patterns are associated with functions responsible for encrypting files and finding files on the system, which are core functionalities of ransomware.
Yara rule that detects RedRoman ransomware.
This YARA rule detects the DogeCrypt ransomware by identifying specific byte patterns associated with its file encryption, file finding, and decryption key container functions. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the Zhen ransomware by identifying specific byte patterns associated with its file finding, file encryption, and network scanning functionalities. The rule looks for distinct sequences of instructions that are characteristic of how Zhen ransomware operates, including patterns related to locating files, encrypting them, and scanning the network for additional targets. The rule requires all three sets of patterns (find_files, encrypt_files, and scan_network) to be present within a PE file (indicated by the 'MZ' header) to trigger a detection.
Yara rule that detects DogeCrypt ransomware.
Yara rule that detects Zhen ransomware.
Yara rule that detects Curator ransomware.
This YARA rule detects the Flamingo ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of byte sequences indicative of the ransomware's operational logic, specifically related to locating files for encryption and the encryption process itself. The rule requires both the 'find_files' and 'encrypt_files' patterns to be present within a PE (Portable Executable) file to trigger, ensuring a higher confidence detection of the Flamingo ransomware.
This YARA rule detects the Pay2Key ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
Yara rule that detects Flamingo ransomware.
Yara rule that detects Pay2Key ransomware.
This YARA rule detects the RegretLocker ransomware by identifying specific byte sequences related to its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for patterns across multiple parts of the malware's code, indicating its presence within a binary.
This YARA rule detects the Seth ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects RegretLocker ransomware.
Yara rule that detects Seth ransomware.
Page 38 of 50