Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the use of wget to download content to a suspicious directory
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Detects wannacry killswitch domain dns queries
Detects a segmentation fault error message caused by a crashing apache worker process
JNDIExploit Pattern
Sigma
Detects exploitation attempt using the JNDI-Exploit-Kit
Yara rule that detects ChinaZ trojan.
This rule detects the Linodas backdoor on Linux systems by identifying specific byte patterns related to its persistence mechanisms for Ubuntu and RedHat distributions, network communication functions, and machine ID generation routines. The rule looks for a combination of these patterns to ensure high fidelity detection of the malware.
This rule detects the Linux_Trojan_AcidRain malware by identifying specific byte patterns associated with its destructive capabilities. The rule looks for functions related to destroying files using ioctls, overwriting files, and redundant reboot attempts, indicating the presence of the AcidRain wiper malware.
Yara rule that detects Linodas backdoor.
Yara rule that detects AcidRain trojan.
This rule detects the Linux_Backdoor_Krasue malware. It identifies specific byte patterns within the executable that correspond to functions for switching servers, getting hostname information, starting server processes, sending encrypted data, and notifying the server. The rule also checks for the ELF magic number to ensure it's a Linux executable.
Yara rule that detects Krasue backdoor.
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
This rule detects the Linux Vit virus by identifying a specific byte sequence at the entry point of an ELF executable and the presence of the string "vi324.tmp" within the file. The rule specifically targets ELF files, indicating its focus on Linux executables.
Linux Virus Vit
YARA
Yara rule that detects Vit virus.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the RedAlert ransomware by identifying specific byte patterns within the executable. The patterns correspond to functions involved in setting up the environment, finding files to encrypt, encrypting files, and making configuration changes, which are characteristic behaviors of the RedAlert ransomware.
Yara rule that detects RedAlert ransomware.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
Page 346 of 347