Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Yara rule that detects TechandStrat ransomware.
This YARA rule detects the Zhen ransomware by identifying specific byte patterns associated with its file finding, file encryption, and network scanning functionalities. The rule looks for distinct sequences of instructions that are characteristic of how Zhen ransomware operates, including patterns related to locating files, encrypting them, and scanning the network for additional targets. The rule requires all three sets of patterns (find_files, encrypt_files, and scan_network) to be present within a PE file (indicated by the 'MZ' header) to trigger a detection.
Yara rule that detects Zhen ransomware.
Yara rule that detects Curator ransomware.
This YARA rule detects the Flamingo ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of byte sequences indicative of the ransomware's operational logic, specifically related to locating files for encryption and the encryption process itself. The rule requires both the 'find_files' and 'encrypt_files' patterns to be present within a PE (Portable Executable) file to trigger, ensuring a higher confidence detection of the Flamingo ransomware.
Yara rule that detects Flamingo ransomware.
Yara rule that detects Pay2Key ransomware.
This YARA rule detects the Seth ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects Seth ransomware.
Yara rule that detects MountLocker ransomware.
This YARA rule detects the Zeoticus ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating network shares, finding files, and encrypting files, which are core behaviors of ransomware. The rule requires all three sets of patterns to be present for a detection, reducing false positives.
Yara rule that detects Knot ransomware.
Yara rule that detects Zeoticus ransomware.
Yara rule that detects DearCry ransomware.
Yara rule that detects Vovalex ransomware.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
Yara rule that detects AnteFrigus ransomware.
This YARA rule detects the FuxSocy ransomware by identifying specific byte patterns associated with its file encryption and file discovery functionalities. The rule targets Windows executable files (indicated by the 'MZ' header) and looks for distinct code sequences that perform actions typical of ransomware, such as locating files on the system and subsequently encrypting them.
Yara rule that detects FuxSocy ransomware.
Yara rule that detects InfoDot ransomware.
This rule detects the ShadowCryptor ransomware based on specific byte patterns indicative of its file finding, file encryption, and antivirus termination routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
Page 198 of 203