Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Yara rule that detects ShadowCryptor ransomware.
Yara rule that detects WinWord64 ransomware.
Yara rule that detects Major ransomware.
This rule detects the Teslarvng ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and network share enumeration capabilities. The rule looks for distinct sequences of bytes that indicate the presence of the ransomware's core functionalities.
Yara rule that detects Teslarvng ransomware.
Yara rule that detects Oni ransomware.
Yara rule that detects WastedLocker ransomware.
This YARA rule detects the Ransomexx ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file to confirm the presence of Ransomexx.
Yara rule that detects GusCrypter ransomware.
Yara rule that detects Badbeeteam ransomware.
Yara rule that detects BlackMoon ransomware.
Yara rule that detects HakunaMatata ransomware.
This YARA rule detects the Dragon ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with remote connections, file discovery, file encryption routines, and a unique characteristic of skipping Hong Kong, China, and Taiwan in its operations. The presence of these combined patterns indicates the likely presence of the Dragon ransomware.
This Yara rule detects the Makop ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE executable (indicated by the 'MZ' header).
Yara rule that detects Dragon ransomware.
Yara rule that detects Makop ransomware.
This YARA rule detects the Lolkek ransomware by identifying specific byte sequences associated with its file encryption routines, volume discovery, and file discovery mechanisms. The rule looks for patterns related to encrypting files, finding logical volumes, and enumerating files, which are characteristic behaviors of ransomware.
Yara rule that detects Outsider ransomware.
Yara rule that detects Saturn ransomware.
This YARA rule detects the Gomer ransomware by identifying specific byte patterns associated with its file enumeration, file finding, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Gomer ransomware operates on a Windows system, specifically in functions related to enumerating drives, finding files, and encrypting them.
Yara rule that detects Gomer ransomware.
Page 199 of 203