Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
This YARA rule detects the Buran ransomware by identifying specific byte patterns related to file enumeration, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This rule detects the CryptoBit ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This rule detects the Defray ransomware by identifying specific byte patterns related to its file finding, special folder enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file to indicate the presence of Defray ransomware.
This rule detects the 'Good' ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the Ladon ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of Ladon ransomware.
This YARA rule detects the MarsJoke ransomware by identifying specific byte patterns related to its file search and encryption routines, as well as patterns associated with its remote connection capabilities. The rule combines three distinct byte signatures to increase accuracy.
This rule detects the Paradise ransomware by identifying specific byte patterns associated with its file searching, encryption routines, and HTTP remote connection capabilities. The rule requires the presence of a PE header (MZ signature) and all specified string patterns to trigger, indicating a high confidence detection of the Paradise ransomware executable.
This YARA rule detects the Revil ransomware by identifying specific byte patterns associated with its file searching, encryption, remote connection, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within executable files that are characteristic of Revil's operations, including functions for searching files to encrypt, performing the encryption itself, establishing remote connections (likely for command and control or data exfiltration), and enumerating system resources.
This YARA rule detects the Satan ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, searching for processes, encrypting files, and searching for files in specific folders. The rule combines these patterns to increase confidence in detection.
This YARA rule detects the Satana ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p1, $encrypt_files_p2) indicative of how the ransomware encrypts files, patterns related to how it searches for files ($search_files_p1, $search_files_p2), and byte sequences involved in establishing remote connections ($remote_connection). The rule requires the presence of the remote connection patterns, along with all file searching and file encryption patterns, to trigger a detection, ensuring a high confidence in identifying Satana ransomware.
This rule detects the Serpent ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to DLL manipulation and thread creation, file enumeration and searching, and establishing remote connections, including FTP. The rule specifically targets the Serpent ransomware family.
This YARA rule detects the TeleCrypt ransomware by identifying specific byte patterns related to its file encryption routines, server communication mechanisms, payload execution, and payload copying functions. The rule looks for a combination of these patterns to ensure high confidence in detection. Specifically, it checks for patterns associated with generating strings for encryption, the encryption process itself, communication with a command and control server, executing the ransomware payload, and copying the payload.
Page 296 of 296