Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,050 detections
Filters
Last updated
All Time
Detection languages
448
250
202
51
27
Contributors
410
155
118
94
48
Categories
628
580
246
179
128
Platforms
988
67
34
20
13
Products / Services
192
142
69
46
28
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,050
CVEs
1
IDS Classtypes
7
IDS Protocols
3
2
1
This YARA rule detects the Ladon ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of Ladon ransomware.
This rule detects the LeChiffre ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule requires all identified patterns to be present in a file to trigger, indicating a high confidence detection for this specific ransomware.
This rule detects the MZP ransomware based on a combination of unique byte patterns found within its executable code. Specifically, it looks for patterns related to showing a ransom note, searching for configuration files, tracking mouse events (potentially for entropy generation or anti-analysis), finding files to encrypt, and the encryption routines themselves. The rule requires all these distinct code segments to be present, indicating a high confidence detection for MZP ransomware.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
This Yara rule detects the Magniber ransomware by identifying specific byte patterns related to its remote connection capabilities, file encryption routines, and file search mechanisms. The rule looks for a combination of these patterns to ensure high confidence in detection.
This rule detects the Maktub ransomware based on specific byte patterns found within the executable. It looks for distinct sequences of bytes associated with file encryption and file searching functionalities characteristic of Maktub ransomware.
This YARA rule detects the Matsnu ransomware based on specific byte sequences indicative of its functionality. The rule looks for patterns related to remote connections, file encryption routines, and file enumeration, suggesting the presence of the Matsnu ransomware.
This YARA rule detects the MarsJoke ransomware by identifying specific byte patterns related to its file search and encryption routines, as well as patterns associated with its remote connection capabilities. The rule combines three distinct byte signatures to increase accuracy.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This rule detects the Montserrat ransomware based on specific byte patterns associated with its file finding, encryption, and service shutdown routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
This rule detects the NanoLocker ransomware based on specific byte patterns found within its executable code. The patterns are associated with functions responsible for file encryption, communication with remote servers, and enumeration of shares for encryption. The rule requires all five defined byte patterns to be present in a PE file (identified by the 'MZ' header) to trigger, aiming to reduce false positives.
This YARA rule detects the Nefilim ransomware by identifying specific byte patterns related to its encryption routines. The rule looks for patterns associated with creating encryption keys, encrypting encryption keys, and multiple parts of the file encryption process, as well as patterns for finding files to encrypt. The rule also checks for the standard Windows PE header (MZ).
This YARA rule detects the Nemty ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The patterns are associated with Nemty's functionalities, including remote connection capabilities, enumeration of resources, file finding operations, and file encryption routines. The rule requires all defined string patterns to be present in a file that starts with the 'MZ' magic bytes (0x5A4D) to trigger a detection.
This YARA rule detects the NotPetya ransomware by identifying specific byte sequences (patterns) associated with its file encryption routine, main execution logic, encryption loop, and system shutdown/reboot mechanisms. The rule requires all four distinct byte patterns to be present within a file, along with the standard Windows PE header (MZ magic bytes), to trigger a detection. This combination of patterns aims to specifically identify NotPetya samples.
This rule detects the Ouroboros ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This YARA rule detects the PXJ ransomware based on specific byte patterns associated with its file finding, file encryption, and volume snapshot deletion functionalities. The rule looks for distinct sequences of bytes that are characteristic of the PXJ ransomware's code, indicating its presence in a binary.
This rule detects the Paradise ransomware by identifying specific byte patterns associated with its file searching, encryption routines, and HTTP remote connection capabilities. The rule requires the presence of a PE header (MZ signature) and all specified string patterns to trigger, indicating a high confidence detection of the Paradise ransomware executable.
This YARA rule detects the PrincessLocker ransomware by identifying specific byte sequences associated with its file encryption routines and remote connection functionalities. The rule looks for three distinct patterns: one related to file encryption operations and two related to establishing remote connections. All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
This Yara rule detects the Ransoc ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include scanning for services, establishing remote connections, finding files to encrypt, and performing file encryption. The rule looks for distinct sequences of assembly instructions that are characteristic of Ransoc's operational methods.
This YARA rule detects the RagnarLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes within executable files that are characteristic of RagnarLocker's operational code.
This YARA rule detects the Revil ransomware by identifying specific byte patterns associated with its file searching, encryption, remote connection, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within executable files that are characteristic of Revil's operations, including functions for searching files to encrypt, performing the encryption itself, establishing remote connections (likely for command and control or data exfiltration), and enumerating system resources.
Page 44 of 50