Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Yara rule that detects AvosLocker ransomware.
Yara rule that detects Jormungand ransomware.
Yara rule that detects TargetCompany ransomware.
Yara rule that detects Motocos ransomware.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Yara rule that detects TaRRaK ransomware.
This rule detects the Namaste ransomware by identifying specific bytecode patterns associated with its file discovery and encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of how Namaste ransomware locates files on a system and subsequently encrypts them. The `find_files_p*` strings target patterns related to file system enumeration, while the `encrypt_files_p*` strings target patterns involved in the encryption process itself. The rule also checks for the standard PE file magic number (0x5A4D) to ensure it's analyzing an executable.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
Yara rule that detects GhosTEncryptor ransomware.
Yara rule that detects Thanos ransomware.
Yara rule that detects WildFire ransomware.
This rule detects the Networm ransomware by identifying specific byte patterns associated with its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
Yara rule that detects Henry ransomware.
Yara rule that detects HowAreYou ransomware.
Yara rule that detects Prometey ransomware.
Yara rule that detects Sarbloh ransomware.
This rule detects the DarkSide ransomware by identifying specific byte patterns (YARA signatures) associated with its functionality. The rule looks for combinations of code that suggest file enumeration, drive enumeration, privilege escalation, and network share enumeration, which are common behaviors of DarkSide ransomware. Specifically, it checks for two main sets of conditions: one involving finding files, enumerating drives, and escalating privileges, and another involving finding files and enumerating network shares. The rule also verifies that the file is a Windows executable (MZ header).
This YARA rule detects the TechandStrat ransomware by identifying specific byte patterns related to its core functionalities. The rule looks for patterns associated with enumerating network shares, finding files on the system, and encrypting files. The presence of these combined patterns indicates the likely presence of the TechandStrat ransomware.
Yara rule that detects DarkSide ransomware.
Page 197 of 203