Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This YARA rule detects the AvosLocker ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for patterns associated with file enumeration ($find_files), resource enumeration ($enum_resources), key import operations ($import_key), and file encryption routines ($encrypt_files). All four string patterns must be present in a file, and the file must start with the MZ header (0x5A4D) to be considered a match.
This YARA rule detects the Jormungand ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include dropping a ransom note, encrypting files using AES and RSA algorithms, finding files to encrypt, and establishing remote connections. The rule specifically looks for these patterns within executable files (indicated by `uint16(0) == 0x5A4D` for MZ header).
Yara rule that detects AvosLocker ransomware.
Yara rule that detects Jormungand ransomware.
This rule detects the Hog ransomware by identifying specific bytecode patterns associated with key generation, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The patterns '$generate_key', '$find_files', and '$encrypt_files_p1' and '$encrypt_files_p2' must all be present for a detection.
Yara rule that detects Hog ransomware.
This rule detects the McBurglar ransomware by identifying specific bytecode patterns related to its setup, file enumeration, salt generation for encryption, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of McBurglar's operations.
This rule detects the presence of TargetCompany ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include encrypting files, generating encryption keys, finding files to encrypt, and establishing remote connections, which are all characteristic behaviors of ransomware.
Yara rule that detects McBurglar ransomware.
Yara rule that detects TargetCompany ransomware.
This YARA rule detects the Bam2021 ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include enumerating shares, finding files for encryption, generating encryption keys, performing file encryption, and establishing remote connections, likely for command and control or data exfiltration.
This YARA rule detects the Motocos ransomware by identifying specific byte patterns associated with its key generation, file finding, and file encryption routines. The rule looks for three distinct sequences of bytes, indicating the presence of the ransomware's core functionalities within a Windows executable.
Yara rule that detects Motocos ransomware.
This rule detects the Ghostbin ransomware by identifying specific bytecode patterns related to environment setup, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the magic number 0x5A4D at the beginning of the file.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Yara rule that detects Ghostbin ransomware.
Yara rule that detects TaRRaK ransomware.
This YARA rule detects the Cring ransomware based on specific bytecode patterns. The rule looks for distinct sequences of bytes related to file finding and encryption operations, which are characteristic of the Cring ransomware family. The presence of these patterns indicates that a file is likely a Cring ransomware executable.
This YARA rule detects the Fantom ransomware by identifying specific byte sequences associated with its file encryption routines, lock file creation, directory locking mechanisms, and key sending functions. The rule looks for a combination of these patterns within a file to confirm the presence of Fantom ransomware.
This rule detects the GhosTEncryptor ransomware by identifying specific byte patterns related to its folder enumeration and encryption routines. The rule looks for a combination of patterns that indicate the ransomware's logic for enumerating folders and encrypting files within those folders, as well as deep search functionalities. The presence of these specific byte sequences, along with the MZ header, strongly suggests the presence of GhosTEncryptor.
This rule detects the Namaste ransomware by identifying specific bytecode patterns associated with its file discovery and encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of how Namaste ransomware locates files on a system and subsequently encrypts them. The `find_files_p*` strings target patterns related to file system enumeration, while the `encrypt_files_p*` strings target patterns involved in the encryption process itself. The rule also checks for the standard PE file magic number (0x5A4D) to ensure it's analyzing an executable.
Page 135 of 149