Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the WastedLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences, '$find_files_p*' and '$encrypt_files_p*', which are indicative of the ransomware's operational code. The presence of all these patterns, combined with the standard PE file magic number (0x5A4D), suggests the presence of the WastedLocker malware.
Yara rule that detects Oni ransomware.
Yara rule that detects WastedLocker ransomware.
This YARA rule detects the GusCrypter ransomware based on specific byte patterns found in its executable code. The patterns are categorized into sections for finding files, encrypting files, and miscellaneous checks, indicating the core functionalities of the ransomware.
This YARA rule detects the Ransomexx ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file to confirm the presence of Ransomexx.
Yara rule that detects GusCrypter ransomware.
Yara rule that detects Ransomexx ransomware.
This rule detects the Dualshot ransomware based on specific byte patterns found within the executable. The patterns are associated with the ransomware's file encryption and file finding functionalities, indicating the presence of the Dualshot malware.
This Yara rule detects the Skystars ransomware. It identifies specific byte patterns ($search_files_p1, $search_files_p2, $encrypt_files, $main_routine) within executable files that are characteristic of the Skystars ransomware's file searching, encryption, and main routine functionalities. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, indicating a high confidence match for the malware.
Yara rule that detects Dualshot ransomware.
Yara rule that detects Skystars ransomware.
This YARA rule detects the Badbeeteam ransomware by identifying specific byte patterns associated with its file finding, file encryption, and HTA file dropping functionalities. The rule looks for distinct sequences of bytes in the executable to identify the presence of this particular ransomware.
This YARA rule detects the Thanatos ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule requires the presence of the standard Windows executable MZ header (0x5A4D at offset 0) and specific byte sequences related to file enumeration and encryption functions within the binary.
Yara rule that detects Badbeeteam ransomware.
Yara rule that detects Thanatos ransomware.
This YARA rule detects the BlackMoon ransomware by identifying specific byte patterns related to file enumeration and encryption routines. The rule looks for a combination of a standard PE file header (MZ header) and distinct byte sequences associated with how BlackMoon ransomware finds and encrypts files.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
Yara rule that detects BlackMoon ransomware.
Yara rule that detects HakunaMatata ransomware.
This YARA rule detects the Dragon ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with remote connections, file discovery, file encryption routines, and a unique characteristic of skipping Hong Kong, China, and Taiwan in its operations. The presence of these combined patterns indicates the likely presence of the Dragon ransomware.
This Yara rule detects the Makop ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE executable (indicated by the 'MZ' header).
Page 218 of 232