Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
This rule detects the ChiChi ransomware by identifying specific byte patterns (YARA signatures) associated with its key generation, file encryption, and file discovery routines. The rule looks for a combination of these patterns within executable files (identified by the MZ header).
Yara rule that detects BlackCat ransomware.
Yara rule that detects ChiChi ransomware.
This YARA rule detects the HarpoonLocker ransomware by identifying specific bytecode patterns related to file encryption, file discovery, and boot modification. The rule looks for distinct sequences of opcodes and operands that are characteristic of how HarpoonLocker encrypts files, finds target files on a system, and attempts to alter boot configurations for persistence or impact.
This YARA rule detects the Khonsari ransomware by identifying specific bytecode patterns related to file enumeration, key retrieval, and file encryption operations. The rule looks for distinct sequences of instructions that are characteristic of how Khonsari ransomware operates, ensuring that all three critical stages (finding files, obtaining an encryption key, and encrypting files) are present within the analyzed binary.
Yara rule that detects HarpoonLocker ransomware.
Yara rule that detects Khonsari ransomware.
This rule detects the Redeemer ransomware by identifying specific byte patterns associated with its file discovery, encryption routines, and process modification activities. The rule looks for a combination of these patterns within a PE file to confirm the presence of Redeemer ransomware.
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
Yara rule that detects Redeemer ransomware.
Yara rule that detects Rook ransomware.
This Yara rule detects the Janelle ransomware by identifying specific bytecode patterns associated with its setup environment, file finding mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Janelle ransomware initializes itself, locates target files, and performs encryption.
This rule detects the Encoded01 ransomware based on specific byte patterns found within the malware's executable. The patterns correspond to functions involved in file enumeration, file encryption, and remote connection activities, which are characteristic behaviors of ransomware.
Yara rule that detects Janelle ransomware.
Yara rule that detects Encoded01 ransomware.
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
This rule detects the DST ransomware by identifying specific byte patterns associated with its core functionalities: encrypting files, finding files to encrypt, and killing processes. The rule looks for distinct sequences of assembly instructions (byte patterns) that are characteristic of how DST ransomware operates. Specifically, it requires all three sets of patterns related to file encryption, file discovery, and process termination to be present within a file to trigger a detection. The rule also checks for the standard Windows executable MZ header (0x5A4D) to ensure it's analyzing a valid executable.
Yara rule that detects TimeCrypt ransomware.
Yara rule that detects DST ransomware.
This rule detects the Apis ransomware by identifying specific bytecode patterns related to its core functionalities: finding files, encrypting files, and setting up its environment. The rule looks for a combination of these distinct bytecode sequences within a file, indicating the presence of the ransomware.
Page 211 of 232