Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Yara rule that detects Babuk ransomware.
Yara rule that detects Major ransomware.
This rule detects the Teslarvng ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and network share enumeration capabilities. The rule looks for distinct sequences of bytes that indicate the presence of the ransomware's core functionalities.
Yara rule that detects Conti ransomware.
Yara rule that detects Teslarvng ransomware.
Yara rule that detects Oni ransomware.
Yara rule that detects WastedLocker ransomware.
This YARA rule detects the Ransomexx ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file to confirm the presence of Ransomexx.
Yara rule that detects GusCrypter ransomware.
Yara rule that detects Dualshot ransomware.
This YARA rule detects the Badbeeteam ransomware by identifying specific byte patterns associated with its file finding, file encryption, and HTA file dropping functionalities. The rule looks for distinct sequences of bytes in the executable to identify the presence of this particular ransomware.
Yara rule that detects Badbeeteam ransomware.
Yara rule that detects Thanatos ransomware.
This YARA rule detects the BlackMoon ransomware by identifying specific byte patterns related to file enumeration and encryption routines. The rule looks for a combination of a standard PE file header (MZ header) and distinct byte sequences associated with how BlackMoon ransomware finds and encrypts files.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
Yara rule that detects BlackMoon ransomware.
Yara rule that detects HakunaMatata ransomware.
This YARA rule detects the Dragon ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with remote connections, file discovery, file encryption routines, and a unique characteristic of skipping Hong Kong, China, and Taiwan in its operations. The presence of these combined patterns indicates the likely presence of the Dragon ransomware.
This Yara rule detects the Makop ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE executable (indicated by the 'MZ' header).
Yara rule that detects Dragon ransomware.
Yara rule that detects Makop ransomware.
Page 139 of 149