Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Yara rule that detects Sifreli ransomware.
This YARA rule detects the Balaclava ransomware based on specific byte patterns found in its executable. The patterns are associated with functions responsible for finding files, encrypting files, and identifying volumes, which are core functionalities of ransomware.
This YARA rule detects the Horsedeal ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for code segments responsible for enumerating system resources, searching for processes, discovering files on the system, and performing file encryption. The presence of all these patterns, along with a valid Windows executable header, indicates the presence of the Horsedeal ransomware.
Yara rule that detects Balaclava ransomware.
Yara rule that detects Horsedeal ransomware.
Yara rule that detects AwesomeScott ransomware.
Yara rule that detects Dridex trojan.
Yara rule that detects BananaCrypt ransomware.
Yara rule that detects Termite ransomware.
This YARA rule detects the ASN1Encoder ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of patterns indicative of ransomware behavior, including functions for finding files, encrypting them, and establishing remote connections, all within a Windows executable (MZ header check).
This YARA rule detects the BadBlock ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for three distinct sets of byte sequences: one related to encrypting files, another for searching files, and a third for establishing remote connections. All three patterns must be present in a file, along with the MZ header (0x5A4D), for a detection to occur.
This YARA rule detects the CryptoFortress ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The rule looks for code sections related to enumerating drives and shared resources, finding files, encrypting files, reading configuration files, and specific encryption routines. The conditions ensure that the detected patterns are present in a PE file (MZ header) and that either a combination of configuration/encryption routines or drive/file enumeration and encryption functions are found.
This YARA rule detects the Crysis ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code related to remote connections, file enumeration, resource enumeration, and file encryption, which are characteristic behaviors of ransomware.
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This YARA rule detects the DMR ransomware by identifying specific byte patterns associated with its file discovery and encryption routines. The rule looks for distinct code segments that are characteristic of how this ransomware locates files on a system and subsequently encrypts them.
This Yara rule detects the DesuCrypt ransomware by identifying specific byte patterns associated with its file enumeration, encryption, and network share discovery functionalities. The rule looks for three distinct sets of byte sequences, all of which must be present in a file for a detection to occur. These patterns likely correspond to core functions within the ransomware's executable code.
This rule detects the District ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential District ransomware samples.
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
This YARA rule detects the HDMR ransomware by identifying specific byte patterns associated with its file finding, encryption, and backup targeting functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the HDMR ransomware's code for locating files, encrypting them, and specifically targeting Microsoft Exchange backups.
This YARA rule detects the Jamper ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential Jamper ransomware samples.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
Page 200 of 203