Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Yara rule that detects LimeRAT backdoor.
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Detects suspicious changes to the Windows Defender configuration
Yara rule that detects BlackBasta ransomware.
Detects the Setting of Windows Defender Exclusions
Yara rule that detects Lorenz ransomware.
Yara rule that detects Eternity ransomware.
Yara rule that detects GoodWill ransomware.
Yara rule that detects WaspLocker ransomware.
Yara rule that detects Monalisa ransomware.
Yara rule that detects Khonsari ransomware.
Yara rule that detects Apis ransomware.
Yara rule that detects Bam2021 ransomware.
Yara rule that detects Fantom ransomware.
Yara rule that detects Povlsomware ransomware.
Yara rule that detects Networm ransomware.
Yara rule that detects Dualshot ransomware.
Yara rule that detects JuicyLemon ransomware.
Yara rule that detects dlMarlboro downloader.
This YARA rule detects the FLKR ransomware based on specific byte patterns found within its executable code. The rule uses three distinct byte sequences ($search_and_encrypt_p1, $search_and_encrypt_p2, $search_and_encrypt_p3) that are characteristic of the ransomware's search and encryption routines. The condition `uint16(0) == 0x5A4D` ensures that the scanned file is a valid Windows executable (MZ header), and `all of ($search_and_encrypt_p*)` requires all three byte patterns to be present for a match, reducing false positives.
Page 42 of 43