Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Yara rule that detects Dragon ransomware.
Yara rule that detects Makop ransomware.
This YARA rule detects the Lolkek ransomware by identifying specific byte sequences associated with its file encryption routines, volume discovery, and file discovery mechanisms. The rule looks for patterns related to encrypting files, finding logical volumes, and enumerating files, which are characteristic behaviors of ransomware.
This rule detects the Outsider ransomware based on specific byte sequences (YARA signatures) found within executable files. The signatures target functions related to file encryption, file enumeration, and resource enumeration, which are characteristic behaviors of ransomware.
Yara rule that detects Lolkek ransomware.
Yara rule that detects Outsider ransomware.
This YARA rule detects the Avaddon ransomware by identifying specific byte sequences related to its file finding, encryption, resource enumeration, and remote connection functionalities. The rule looks for a combination of these distinct patterns within a file, indicating the presence of Avaddon ransomware.
This rule detects the Saturn ransomware by identifying specific byte patterns within executable files. The patterns are associated with the ransomware's file enumeration and encryption routines. The rule requires the presence of the standard PE magic bytes (MZ header) and all defined byte patterns related to file finding and encryption to trigger.
Yara rule that detects Avaddon ransomware.
Yara rule that detects Saturn ransomware.
This YARA rule detects the Gomer ransomware by identifying specific byte patterns associated with its file enumeration, file finding, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Gomer ransomware operates on a Windows system, specifically in functions related to enumerating drives, finding files, and encrypting them.
This YARA rule detects the Sifreli ransomware by identifying specific byte patterns related to file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to classify it as Sifreli ransomware.
Yara rule that detects Gomer ransomware.
Yara rule that detects Sifreli ransomware.
This YARA rule detects the Balaclava ransomware based on specific byte patterns found in its executable. The patterns are associated with functions responsible for finding files, encrypting files, and identifying volumes, which are core functionalities of ransomware.
This YARA rule detects the Horsedeal ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for code segments responsible for enumerating system resources, searching for processes, discovering files on the system, and performing file encryption. The presence of all these patterns, along with a valid Windows executable header, indicates the presence of the Horsedeal ransomware.
Yara rule that detects Balaclava ransomware.
Yara rule that detects Horsedeal ransomware.
This YARA rule detects the AwesomeScott ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for a combination of three distinct byte sequences related to file encryption ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) and one byte sequence related to file discovery ($find_files). All identified patterns must be present for a match, along with the standard Windows executable MZ header (uint16(0) == 0x5A4D).
This YARA rule detects the Dridex banking Trojan by identifying specific byte patterns (API wrapper functions and file search snippets) commonly found in its executables. The rule requires the file to be a Windows executable (MZ header) and contain at least one of the defined API wrapper patterns and one of the file search patterns.
Yara rule that detects AwesomeScott ransomware.
Page 219 of 232