Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This YARA rule detects the Alcatraz ransomware by identifying specific byte patterns associated with its file encryption routines and its communication with remote servers. The rule looks for three distinct byte sequences: one related to file encryption logic ($encrypt_files) and two others related to remote server communication ($remote_server and $remote_server_2). All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
Yara rule that detects Alcatraz ransomware.
Yara rule that detects Marlboro ransomware.
This rule detects the 5ss5c ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
This YARA rule detects the ASN1Encoder ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of patterns indicative of ransomware behavior, including functions for finding files, encrypting them, and establishing remote connections, all within a Windows executable (MZ header check).
This rule detects the Ako ransomware by identifying specific byte patterns associated with its functionality. The patterns cover functions related to encrypting network shares, finding files, and encrypting files on a Windows system. The rule requires all three sets of patterns to be present, indicating a high confidence match for the Ako ransomware.
This YARA rule detects the Armage ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within the executable, specifically in functions related to encrypting files, finding files to encrypt, and enumerating system resources, which are characteristic behaviors of ransomware.
This YARA rule detects the Atlas ransomware by identifying specific byte patterns related to file encryption routines and network communication patterns, including sending POST and GET requests to remote servers. The rule looks for a combination of these patterns to minimize false positives.
This rule detects the BKRansomware ransomware based on specific byte patterns found within the executable. It looks for a combination of patterns related to file searching and encryption routines, indicating the presence of this particular ransomware strain.
This YARA rule detects the BadBlock ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for three distinct sets of byte sequences: one related to encrypting files, another for searching files, and a third for establishing remote connections. All three patterns must be present in a file, along with the MZ header (0x5A4D), for a detection to occur.
This YARA rule detects the Blitzkrieg ransomware by identifying specific byte patterns associated with its core functionalities: file encryption, searching for files to encrypt, and disabling services. The rule looks for distinct sequences of bytes that indicate these malicious behaviors within a Windows executable file.
This YARA rule detects the Buran ransomware by identifying specific byte patterns related to file enumeration, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Clop ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and its capability to uninstall ESET antivirus software. The rule looks for distinct sequences of bytes that are characteristic of Clop's operational methods.
This YARA rule detects the Cryakl ransomware by identifying specific byte sequences associated with its file enumeration and encryption routines. The rule looks for two distinct patterns, `$enum_and_encrypt_files_1` and `$enum_and_encrypt_files_2`, within a file that also starts with the MZ header (0x5A4D). These patterns are indicative of the ransomware's core functionality related to finding and encrypting files on a system.
This YARA rule detects the Crypren ransomware by identifying specific byte sequences associated with its functionality. The rule looks for patterns related to enumerating directories, enumerating drives, and encrypting files, which are core behaviors of ransomware.
This rule detects the CryptoBit ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the CryptoFortress ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The rule looks for code sections related to enumerating drives and shared resources, finding files, encrypting files, reading configuration files, and specific encryption routines. The conditions ensure that the detected patterns are present in a PE file (MZ header) and that either a combination of configuration/encryption routines or drive/file enumeration and encryption functions are found.
This Yara rule detects the CryptoJoker ransomware based on specific byte sequences found within the malware's code. The rule looks for patterns related to encryption calls, file encryption routines, process initiation, message box timers, and unpacking/assembly resolution, indicating the presence of CryptoJoker.
This YARA rule detects the CryptoLocker ransomware by identifying specific byte sequences (strings) associated with its file looping, data encryption, and data decryption routines. The rule looks for combinations of these patterns within executable files (identified by the 'MZ' header) to increase accuracy.
This YARA rule detects various versions of the CryptoWall ransomware based on specific byte patterns found at the entry point and within API loading, hash calculation, file finding, and file encryption routines. It targets both version 2.0 and 3.0 variants of the ransomware by looking for distinct code sequences indicative of their malicious functionality.
This YARA rule detects the Crysis ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code related to remote connections, file enumeration, resource enumeration, and file encryption, which are characteristic behaviors of ransomware.
Page 42 of 50