Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This rule detects the Cuba ransomware based on specific byte patterns found within the executable. The patterns are associated with functions for enumerating resources, finding files, and encrypting files, which are characteristic behaviors of ransomware.
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This YARA rule detects the DMR ransomware by identifying specific byte patterns associated with its file discovery and encryption routines. The rule looks for distinct code segments that are characteristic of how this ransomware locates files on a system and subsequently encrypts them.
This rule detects the Defray ransomware by identifying specific byte patterns related to its file finding, special folder enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file to indicate the presence of Defray ransomware.
This YARA rule detects the Delphimorix ransomware by identifying specific byte sequences (patterns) associated with its file encryption and file finding routines. The rule looks for a combination of these patterns within a file, along with the MZ header (0x5A4D) indicating a Windows executable.
This Yara rule detects the DesuCrypt ransomware by identifying specific byte patterns associated with its file enumeration, encryption, and network share discovery functionalities. The rule looks for three distinct sets of byte sequences, all of which must be present in a file for a detection to occur. These patterns likely correspond to core functions within the ransomware's executable code.
This rule detects the Dharma ransomware based on specific byte patterns found within the executable. The patterns indicate functionalities related to file searching, encryption routines, and enumeration of network shares, which are characteristic behaviors of Dharma ransomware.
This rule detects the District ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential District ransomware samples.
This YARA rule detects the FenixLocker ransomware by identifying specific byte sequences ($encrypt_files_1, $encrypt_files_2, $encrypt_files_3, $encrypt_files_4, $encrypt_files_5) within executable files. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) indicating a Windows executable, along with a combination of these byte sequences to trigger. The identified byte sequences are indicative of the ransomware's file encryption routines.
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
This YARA rule detects the GarrantyDecrypt ransomware by identifying specific byte patterns associated with its file encryption and file finding functionalities. The rule looks for a valid PE header (MZ magic bytes) and then checks for the presence of three distinct byte sequences: one related to finding files and two related to encrypting files. These patterns are indicative of the ransomware's core operations.
This YARA rule detects the Gibon ransomware by identifying specific byte patterns related to remote server connections and encryption loops within executable files. The rule requires the presence of a standard Windows PE header (MZ) and a combination of byte sequences indicative of Gibon's network communication and file encryption routines.
This YARA rule detects the GlobeImposter ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and process termination functions. The rule looks for combinations of these patterns within executable files to increase detection accuracy.
This YARA rule detects the GPCode ransomware by identifying specific byte sequences related to its core functionalities. These include patterns for iterating through drives, the encryption routine itself, setting a ransomware wallpaper, and reading configuration files. The rule requires all four byte patterns to be present within a file that starts with the MZ header (indicating a Windows executable) to trigger a detection.
This rule detects the 'Good' ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the HDDCryptor ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include deploying components, gathering share information, encrypting disks, creating a DiskCryptor service, extracting DiskCryptor from resources, encrypting files, and initiating a system reboot. The rule looks for combinations of these patterns to ensure high confidence in detection.
This YARA rule detects the HDMR ransomware by identifying specific byte patterns associated with its file finding, encryption, and backup targeting functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the HDMR ransomware's code for locating files, encrypting them, and specifically targeting Microsoft Exchange backups.
This YARA rule detects the HydraCrypt ransomware by identifying specific byte patterns associated with its file encryption routines and remote connection capabilities. The rule looks for two distinct sets of patterns, each combining multiple encryption-related and remote connection-related byte sequences, indicating the presence of the ransomware.
This YARA rule detects the IFN643 ransomware by identifying specific byte patterns associated with its code. The rule looks for a Windows executable (MZ header) and then matches three distinct byte sequences, likely corresponding to its file searching and encryption functionalities. The rule's primary purpose is to identify the presence of this specific ransomware variant on a system.
This YARA rule detects the Jamper ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential Jamper ransomware samples.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
Page 43 of 50