Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Yara rule that detects LimeRAT backdoor.
Yara rule that detects Krasue backdoor.
This Yara rule detects the presence of Cactus ransomware by identifying specific byte patterns associated with its file encryption, file discovery, process checking, and process killing functionalities. The rule looks for distinct sequences of bytes within executable files, indicating the presence of Cactus ransomware components.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
Yara rule that detects AgentRacoon backdoor.
Yara rule that detects Cactus ransomware.
Yara rule that detects Konni backdoor.
Yara rule that detects Konni backdoor.
Yara rule that detects LumarStealer infostealer.
This YARA rule detects the BiBiWiper trojan by identifying specific byte sequences associated with its shadow copy deletion and file destruction functionalities. The rule looks for two distinct patterns, '$delete_shadow_copies_p*' and '$destroy_files_p*', which are indicative of the malware's destructive behavior. The presence of both sets of patterns within a file, combined with the MZ header (0x5A4D), triggers the detection.
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
This rule detects the Linux Vit virus by identifying a specific byte sequence at the entry point of an ELF executable and the presence of the string "vi324.tmp" within the file. The rule specifically targets ELF files, indicating its focus on Linux executables.
Linux Virus Vit
YARA
Yara rule that detects Vit virus.
This rule detects the Minodo backdoor by identifying a combination of specific byte patterns (YARA signatures) within executable files. These patterns correspond to functions responsible for generating system IDs, encrypting and sending data, gathering system information, copying payloads into memory, and executing payloads from temporary locations. The presence of all these patterns indicates the likely presence of the Minodo backdoor.
This rule detects the StealC infostealer malware by identifying specific byte patterns within the executable. These patterns correspond to functions for resolving Windows APIs, loading SQLite3 functions (often used by infostealers to extract data from browsers and other applications), and checking license expiration dates, which are characteristic of this particular malware family. The rule requires all three patterns to be present in a PE file (identified by the 'MZ' header) to trigger, reducing false positives.
Yara rule that detects Minodo backdoor.
Page 207 of 232