Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
This rule detects the ZeroLocker ransomware by identifying specific bytecode patterns within executable files. The rule looks for three distinct encryption routine patterns ($encrypt_routine_1, $encrypt_routine_2, and $encrypt_routine_3) in files that start with the 'MZ' header (indicating a Windows executable). The presence of all three patterns strongly suggests the file is ZeroLocker ransomware.
This YARA rule detects the CobraLocker ransomware by identifying specific bytecode patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns in the `encrypt_files` and `find_files` sections, along with checking for the MZ header (uint16(0) == 0x5A4D) to ensure it's an executable.
Yara rule that detects Cring ransomware.
Yara rule that detects Dusk ransomware.
Yara rule that detects Fantom ransomware.
Yara rule that detects GhosTEncryptor ransomware.
Yara rule that detects Namaste ransomware.
Yara rule that detects Oct ransomware.
Yara rule that detects Pacman ransomware.
Yara rule that detects Povlsomware ransomware.
Yara rule that detects Retis ransomware.
Yara rule that detects Thanos ransomware.
Yara rule that detects WildFire ransomware.
Yara rule that detects WormLocker ransomware.
Yara rule that detects ZeroLocker ransomware.
Yara rule that detects CobraLocker ransomware.
This rule detects the Networm ransomware by identifying specific byte patterns associated with its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This rule detects the WhiteBlackCrypt ransomware by identifying specific byte patterns associated with its file finding, file encryption, and service registration functionalities. The rule looks for a combination of these patterns within a PE file, indicated by the 'MZ' header.
Page 214 of 232