Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Yara rule that detects StealC infostealer.
This YARA rule detects various components and behaviors associated with the BlackBasta ransomware. It identifies specific byte patterns related to file discovery, encryption routines (multiple versions), command prompt execution, LDAP connection attempts, dropping of ransom notes, and exclusion logic for files/volumes from encryption. The rule is designed to catch the ransomware executable itself based on these unique code signatures.
This YARA rule detects the BlackBasta ransomware by identifying specific byte patterns within executable files. The patterns correspond to various functionalities commonly found in ransomware, such as enumerating files, interacting with system volumes, dropping ransom notes, excluding certain files from encryption, and the encryption routines themselves. The rule looks for two main variants of these functionalities, indicating different versions or implementations of BlackBasta.
Yara rule that detects BlackBasta ransomware.
Yara rule that detects BlackBasta ransomware.
This YARA rule detects the Lorenz ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, scheduled task creation for persistence, and remote connection functionalities. The rule includes two main versions of the ransomware's code, covering different implementations of these malicious activities.
This YARA rule detects the Meow ransomware based on specific byte patterns found in its executable code. The rule looks for patterns associated with file encryption routines, the dropping of a ransom note, and functions used to find files on the system. The condition requires the presence of the MZ header (indicating a Windows executable) and all defined string patterns to match, ensuring a high-fidelity detection of the Meow ransomware.
Yara rule that detects Lorenz ransomware.
Yara rule that detects Meow ransomware.
This rule detects the Moisha ransomware by identifying specific bytecode patterns related to file enumeration, private key importation, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Moisha's operational methodology.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects Moisha ransomware.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the RedAlert ransomware by identifying specific byte patterns within the executable. The patterns correspond to functions involved in setting up the environment, finding files to encrypt, encrypting files, and making configuration changes, which are characteristic behaviors of the RedAlert ransomware.
Yara rule that detects RedAlert ransomware.
This YARA rule detects the Acepy ransomware by identifying specific byte patterns associated with its core functionalities: finding files to encrypt, performing the encryption process, and dropping a ransom note. The rule requires all three patterns to be present within a Windows executable file (indicated by the MZ header) to trigger a detection.
This rule detects the BlueLocker ransomware by identifying specific byte patterns related to its file encryption and file finding routines, as well as its cryptographic context creation. The rule looks for three distinct parts of the encryption process ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3), two parts of the file finding process ($find_files_p1, $find_files_p2), and a pattern for creating the cryptographic context ($create_crypt_context). All these patterns must be present for a detection to occur, indicating the presence of the BlueLocker ransomware.
Yara rule that detects Acepy ransomware.
Yara rule that detects BlueLocker ransomware.
This Yara rule detects the PoliceRecords ransomware. It identifies specific byte sequences related to file encryption, file discovery, desktop manipulation (likely for displaying a ransom note or changing wallpaper), and the dropping of a ransom note. The rule looks for these distinct patterns within executable files (identified by the 'MZ' header).
This YARA rule detects the WsIR ransomware based on specific byte sequences found in its code. The rule looks for patterns associated with file enumeration ($find_files), file encryption ($encrypt_files), and process execution ($exec_proc). The presence of all three patterns indicates the likely presence of the WsIR ransomware.
Page 208 of 232