Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Yara rule that detects Networm ransomware.
Yara rule that detects WhiteBlackCrypt ransomware.
This YARA rule detects the Henry ransomware by identifying specific byte sequences related to its core functionalities. These functionalities include finding files for encryption, performing the encryption process, setting up its operational environment, and initializing its components. The rule requires all four sets of byte patterns to be present in a file, along with the MZ header, to minimize false positives.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
Yara rule that detects Henry ransomware.
Yara rule that detects HowAreYou ransomware.
This YARA rule detects the Prometey ransomware based on specific byte patterns found in its executable code. The patterns indicate functionality related to remote connections, file discovery, and file encryption, which are characteristic behaviors of ransomware.
Yara rule that detects Prometey ransomware.
This YARA rule detects the Sarbloh ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for distinct sequences of bytes in the executable, indicating the presence of Sarbloh's core functionalities for locating and encrypting files.
Yara rule that detects Sarbloh ransomware.
This rule detects the DarkSide ransomware by identifying specific byte patterns (YARA signatures) associated with its functionality. The rule looks for combinations of code that suggest file enumeration, drive enumeration, privilege escalation, and network share enumeration, which are common behaviors of DarkSide ransomware. Specifically, it checks for two main sets of conditions: one involving finding files, enumerating drives, and escalating privileges, and another involving finding files and enumerating network shares. The rule also verifies that the file is a Windows executable (MZ header).
This YARA rule detects the TechandStrat ransomware by identifying specific byte patterns related to its core functionalities. The rule looks for patterns associated with enumerating network shares, finding files on the system, and encrypting files. The presence of these combined patterns indicates the likely presence of the TechandStrat ransomware.
Yara rule that detects DarkSide ransomware.
Yara rule that detects TechandStrat ransomware.
This rule detects the RedRoman ransomware based on specific byte patterns found in its executable code. The patterns are associated with functions responsible for encrypting files and finding files on the system, which are core functionalities of ransomware.
Yara rule that detects RedRoman ransomware.
This YARA rule detects the DogeCrypt ransomware by identifying specific byte patterns associated with its file encryption, file finding, and decryption key container functions. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the Zhen ransomware by identifying specific byte patterns associated with its file finding, file encryption, and network scanning functionalities. The rule looks for distinct sequences of instructions that are characteristic of how Zhen ransomware operates, including patterns related to locating files, encrypting them, and scanning the network for additional targets. The rule requires all three sets of patterns (find_files, encrypt_files, and scan_network) to be present within a PE file (indicated by the 'MZ' header) to trigger a detection.
Yara rule that detects DogeCrypt ransomware.
Yara rule that detects Zhen ransomware.
This rule detects the Curator ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file, indicating the presence of the ransomware.
Page 215 of 232