Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Yara rule that detects Curator ransomware.
This YARA rule detects the Flamingo ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of byte sequences indicative of the ransomware's operational logic, specifically related to locating files for encryption and the encryption process itself. The rule requires both the 'find_files' and 'encrypt_files' patterns to be present within a PE (Portable Executable) file to trigger, ensuring a higher confidence detection of the Flamingo ransomware.
This YARA rule detects the Pay2Key ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
Yara rule that detects Flamingo ransomware.
Yara rule that detects Pay2Key ransomware.
This YARA rule detects the RegretLocker ransomware by identifying specific byte sequences related to its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for patterns across multiple parts of the malware's code, indicating its presence within a binary.
This YARA rule detects the Seth ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects RegretLocker ransomware.
Yara rule that detects Seth ransomware.
This rule detects the MountLocker ransomware based on specific byte patterns found within its executable code. The patterns are associated with functions responsible for encrypting files and finding files to encrypt, which are core functionalities of ransomware.
Yara rule that detects MountLocker ransomware.
This YARA rule detects the Knot ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes that are characteristic of how Knot ransomware encrypts files, finds target files on a system, and establishes remote connections, indicating the presence and activity of this specific malware.
This YARA rule detects the Zeoticus ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating network shares, finding files, and encrypting files, which are core behaviors of ransomware. The rule requires all three sets of patterns to be present for a detection, reducing false positives.
Yara rule that detects Knot ransomware.
Yara rule that detects Zeoticus ransomware.
This rule detects the DearCry ransomware based on specific byte patterns found within its executable code. The patterns are associated with the ransomware's functionality for dropping ransom notes and finding files to encrypt.
This YARA rule detects the Vovalex ransomware by identifying specific byte patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns related to how the ransomware encrypts files and how it finds files on the system, ensuring a high confidence detection of the Vovalex malware.
Yara rule that detects DearCry ransomware.
Yara rule that detects Vovalex ransomware.
This YARA rule detects the AnteFrigus ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files on the system, encrypting files, and establishing remote connections, likely for command and control or data exfiltration. The rule also checks for the standard Windows executable 'MZ' header.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
Page 216 of 232