Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the McBurglar ransomware by identifying specific bytecode patterns related to its setup, file enumeration, salt generation for encryption, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of McBurglar's operations.
This rule detects the presence of TargetCompany ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include encrypting files, generating encryption keys, finding files to encrypt, and establishing remote connections, which are all characteristic behaviors of ransomware.
Yara rule that detects McBurglar ransomware.
Yara rule that detects TargetCompany ransomware.
This YARA rule detects the Bam2021 ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include enumerating shares, finding files for encryption, generating encryption keys, performing file encryption, and establishing remote connections, likely for command and control or data exfiltration.
This YARA rule detects the Motocos ransomware by identifying specific byte patterns associated with its key generation, file finding, and file encryption routines. The rule looks for three distinct sequences of bytes, indicating the presence of the ransomware's core functionalities within a Windows executable.
Yara rule that detects Bam2021 ransomware.
Yara rule that detects Motocos ransomware.
This rule detects the Ghostbin ransomware by identifying specific bytecode patterns related to environment setup, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the magic number 0x5A4D at the beginning of the file.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Yara rule that detects Ghostbin ransomware.
Yara rule that detects TaRRaK ransomware.
This YARA rule detects the Cring ransomware based on specific bytecode patterns. The rule looks for distinct sequences of bytes related to file finding and encryption operations, which are characteristic of the Cring ransomware family. The presence of these patterns indicates that a file is likely a Cring ransomware executable.
This rule detects the Dusk ransomware by identifying specific bytecode patterns associated with its file encryption routines, file finding mechanisms, and self-deletion functionality. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header.
This YARA rule detects the Fantom ransomware by identifying specific byte sequences associated with its file encryption routines, lock file creation, directory locking mechanisms, and key sending functions. The rule looks for a combination of these patterns within a file to confirm the presence of Fantom ransomware.
This rule detects the GhosTEncryptor ransomware by identifying specific byte patterns related to its folder enumeration and encryption routines. The rule looks for a combination of patterns that indicate the ransomware's logic for enumerating folders and encrypting files within those folders, as well as deep search functionalities. The presence of these specific byte sequences, along with the MZ header, strongly suggests the presence of GhosTEncryptor.
This rule detects the Namaste ransomware by identifying specific bytecode patterns associated with its file discovery and encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of how Namaste ransomware locates files on a system and subsequently encrypts them. The `find_files_p*` strings target patterns related to file system enumeration, while the `encrypt_files_p*` strings target patterns involved in the encryption process itself. The rule also checks for the standard PE file magic number (0x5A4D) to ensure it's analyzing an executable.
This rule detects the Oct ransomware based on specific bytecode patterns associated with its file encryption, file finding, and environment collection routines. The rule looks for a combination of three distinct byte sequences within a PE file, indicating the presence of Oct ransomware functionality.
This YARA rule detects the Retis ransomware by identifying specific byte sequences related to its file searching, drive enumeration, and file encryption functionalities. The rule looks for three distinct patterns: one associated with searching files, another with enumerating drives, and a third with the encryption process. All three patterns must be present for a detection to occur, along with the standard PE file magic number (MZ header).
This YARA rule detects the Pacman ransomware by identifying specific byte code patterns within executable files. The rule looks for distinct sequences of bytes associated with the ransomware's file encryption and file finding functionalities, indicating the presence of Pacman ransomware.
This Yara rule detects the Povlsomware ransomware. It identifies specific bytecode patterns associated with the ransomware's setup, file discovery, and encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file (indicated by the 'MZ' header).
Page 213 of 232