Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Yara rule that detects Pandora ransomware.
This YARA rule detects the Monalisa ransomware by identifying specific byte sequences (strings) associated with its core functionalities. These functionalities include finding files for encryption, writing to process memory (potentially for injection or other malicious operations), generating encryption keys, and encrypting files. The rule also checks for the standard Windows PE header (MZ) to ensure it's analyzing an executable.
This YARA rule detects the HermeticRansom ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to dropping a ransom note, encrypting files, and finding files to encrypt. The presence of these combined patterns indicates the presence of the HermeticRansom malware.
Yara rule that detects HermeticRansom ransomware.
This YARA rule detects the Koxic ransomware by identifying specific byte patterns related to its core functionalities. These patterns include code for enumerating network shares, finding files on the system, and encrypting files. The rule combines these patterns to increase confidence in detecting Koxic ransomware executables.
This rule detects the AntiWar ransomware based on specific byte patterns indicative of its file enumeration, share enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file (identified by the 'MZ' header).
Yara rule that detects Koxic ransomware.
This YARA rule detects LockBit ransomware by identifying specific byte patterns (signatures) within executable files. It contains two main sets of conditions, likely corresponding to different versions or major functional blocks of the ransomware. The first set looks for patterns related to enumerating resources, finding files, and encrypting files. The second set looks for patterns related to checking blacklisted languages (anti-analysis/anti-geofencing), FNV1a hashing, creating network host traversal threads, decrypting configuration, and encrypting files. The rule requires the file to be a Windows executable (MZ header).
Yara rule that detects LockBit ransomware.
This rule detects the CaddyWiper trojan, a destructive data wiper, by identifying specific byte patterns within executable files. The patterns correspond to functions involved in destroying data if the system is not a controller, erasing drive data, and recursively erasing drives.
Yara rule that detects CaddyWiper trojan.
This YARA rule detects the IsaacWiper trojan by identifying specific byte patterns related to its functionality. The rule looks for two distinct code sections: one responsible for enumerating physical drives and another for corrupting drive data. The presence of both patterns indicates the likely presence of the IsaacWiper malware, which is known for its destructive disk wiping capabilities.
Yara rule that detects IsaacWiper trojan.
Yara rule that detects HermeticWiper trojan.
This rule detects the TimeTime ransomware by identifying specific bytecode patterns associated with its file enumeration, encryption, and renaming activities. The rule looks for distinct sequences of operations related to finding files, encrypting files, encrypting folders, and renaming files, which are characteristic behaviors of ransomware.
This YARA rule detects the MRAC ransomware by identifying specific byte patterns associated with its file encryption routines, key import mechanisms, and file discovery functions. The rule looks for a combination of these patterns within a file, ensuring a higher confidence in detection.
Yara rule that detects TimeTime ransomware.
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Yara rule that detects BlackCat ransomware.
Yara rule that detects ChiChi ransomware.
This YARA rule detects the HarpoonLocker ransomware by identifying specific bytecode patterns related to file encryption, file discovery, and boot modification. The rule looks for distinct sequences of opcodes and operands that are characteristic of how HarpoonLocker encrypts files, finds target files on a system, and attempts to alter boot configurations for persistence or impact.
Page 133 of 149