Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Yara rule that detects Lolkek ransomware.
Yara rule that detects Outsider ransomware.
This YARA rule detects the Avaddon ransomware by identifying specific byte sequences related to its file finding, encryption, resource enumeration, and remote connection functionalities. The rule looks for a combination of these distinct patterns within a file, indicating the presence of Avaddon ransomware.
Yara rule that detects Avaddon ransomware.
Yara rule that detects Saturn ransomware.
This YARA rule detects the Gomer ransomware by identifying specific byte patterns associated with its file enumeration, file finding, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Gomer ransomware operates on a Windows system, specifically in functions related to enumerating drives, finding files, and encrypting them.
This YARA rule detects the Sifreli ransomware by identifying specific byte patterns related to file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to classify it as Sifreli ransomware.
Yara rule that detects Gomer ransomware.
Yara rule that detects Sifreli ransomware.
This YARA rule detects the Balaclava ransomware based on specific byte patterns found in its executable. The patterns are associated with functions responsible for finding files, encrypting files, and identifying volumes, which are core functionalities of ransomware.
This YARA rule detects the Horsedeal ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for code segments responsible for enumerating system resources, searching for processes, discovering files on the system, and performing file encryption. The presence of all these patterns, along with a valid Windows executable header, indicates the presence of the Horsedeal ransomware.
Yara rule that detects Balaclava ransomware.
Yara rule that detects Horsedeal ransomware.
Yara rule that detects AwesomeScott ransomware.
Yara rule that detects BananaCrypt ransomware.
Yara rule that detects Termite ransomware.
This YARA rule detects the KawaiiLocker ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences related to file searching, remote connections, and file encryption routines, indicating the presence and functionality of the KawaiiLocker ransomware.
Yara rule that detects JuicyLemon ransomware.
This YARA rule detects the Alcatraz ransomware by identifying specific byte patterns associated with its file encryption routines and its communication with remote servers. The rule looks for three distinct byte sequences: one related to file encryption logic ($encrypt_files) and two others related to remote server communication ($remote_server and $remote_server_2). All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
Yara rule that detects Marlboro ransomware.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
Page 140 of 149