Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the HotCoffee ransomware. It identifies specific byte patterns related to the ransomware's functionality, including enumerating drives, finding files, encrypting files, and dropping a ransom note. The rule looks for a combination of these patterns to ensure high confidence in detection.
Yara rule that detects Apis ransomware.
Yara rule that detects HotCoffee ransomware.
This YARA rule detects various versions of the Emotet trojan by identifying specific byte patterns (hexadecimal sequences) associated with its resource decryption and filename generation routines, as well as its use of the liblzf decompression algorithm and state machine snippets. The rule looks for combinations of these patterns within executable files (indicated by the 'MZ' header).
Yara rule that detects Emotet trojan.
This YARA rule detects the Invert ransomware by identifying specific byte sequences related to its file encryption, file finding, and file listing functionalities. The rule looks for distinct patterns in the compiled bytecode that are characteristic of the Invert ransomware's operations.
This rule detects the Sanwai ransomware based on specific byte patterns found within its executable code. The patterns '$find_files', '$import_key', and '$encrypt_files' are indicative of the ransomware's file searching, key importing, and file encryption functionalities. The rule also checks for the standard Windows executable magic number (MZ header).
Yara rule that detects Invert ransomware.
Yara rule that detects Sanwai ransomware.
This rule detects the Solaso ransomware by identifying specific byte patterns related to its file finding and encryption routines. The rule looks for distinct sequences of bytes within the executable, indicating the presence of Solaso ransomware.
This rule detects the Wintenzz ransomware by identifying specific byte patterns related to its file finding, encryption, and ransom note dropping functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects Solaso ransomware.
Yara rule that detects Wintenzz ransomware.
This YARA rule detects the AvosLocker ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for patterns associated with file enumeration ($find_files), resource enumeration ($enum_resources), key import operations ($import_key), and file encryption routines ($encrypt_files). All four string patterns must be present in a file, and the file must start with the MZ header (0x5A4D) to be considered a match.
This YARA rule detects the Jormungand ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include dropping a ransom note, encrypting files using AES and RSA algorithms, finding files to encrypt, and establishing remote connections. The rule specifically looks for these patterns within executable files (indicated by `uint16(0) == 0x5A4D` for MZ header).
Yara rule that detects AvosLocker ransomware.
Yara rule that detects Jormungand ransomware.
This rule detects the ChupaCabra ransomware by identifying specific bytecode patterns associated with its file encryption routines, file discovery mechanisms, and the dropping of a ransom note. The rule looks for distinct sequences of operations related to encrypting files, finding files on the system, and creating the ransom note, indicating the presence and activity of this particular ransomware.
This rule detects the Hog ransomware by identifying specific bytecode patterns associated with key generation, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The patterns '$generate_key', '$find_files', and '$encrypt_files_p1' and '$encrypt_files_p2' must all be present for a detection.
Yara rule that detects ChupaCabra ransomware.
Yara rule that detects Hog ransomware.
Page 212 of 232