Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Yara rule that detects Dridex trojan.
This rule detects the BananaCrypt ransomware based on specific byte patterns found in its 'encrypt_files' and 'find_files' functions. The rule looks for a combination of these patterns within a PE (Portable Executable) file, indicated by the 'MZ' header.
Yara rule that detects BananaCrypt ransomware.
This YARA rule detects the Termite ransomware by identifying specific byte sequences (patterns) associated with its file finding and encryption routines. The rule looks for distinct code blocks that are characteristic of how Termite ransomware operates to locate files and then encrypt them. The rule requires all parts of the 'find_files' patterns and all parts of the 'encrypt_files' patterns to be present, along with the MZ header (0x5A4D) indicating a Windows executable, to minimize false positives.
Yara rule that detects Termite ransomware.
This YARA rule detects the JuicyLemon ransomware by identifying specific byte sequences related to remote connections and file encryption routines. The rule looks for three distinct patterns: two associated with remote connection functionalities and one with the core logic for finding and encrypting files. All three patterns must be present, along with the standard Windows PE magic number (0x5A4D), to trigger a detection.
This YARA rule detects the KawaiiLocker ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences related to file searching, remote connections, and file encryption routines, indicating the presence and functionality of the KawaiiLocker ransomware.
Yara rule that detects JuicyLemon ransomware.
Yara rule that detects KawaiiLocker ransomware.
This rule detects the Domaiq Potentially Unwanted Application (PUA) by identifying a specific payload string and a combination of code patterns. These patterns include checks for NSIS (Nullsoft Scriptable Install System) integrity, UPX (Ultimate Packer for eXecutables) decompression and encryption, various dumping functions, and exception handling routines. The presence of these combined signatures indicates the likely presence of the Domaiq PUA.
This YARA rule detects the Alcatraz ransomware by identifying specific byte patterns associated with its file encryption routines and its communication with remote servers. The rule looks for three distinct byte sequences: one related to file encryption logic ($encrypt_files) and two others related to remote server communication ($remote_server and $remote_server_2). All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
Win32 PUA Domaiq
YARA
Yara rule that detects Domaiq potentially unwanted application.
Yara rule that detects Alcatraz ransomware.
This rule detects the dlMarlboro downloader based on specific byte patterns found within the executable. The patterns '$ping_apnic', '$download_bin_1', and '$download_bin_2' are indicative of the malware's code for network communication (pinging apnic) and downloading additional binaries.
This YARA rule detects the Marlboro ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with network communication (pinging APNIC, remote server connections) and file encryption routines. The presence of these combined patterns indicates the likely presence of the Marlboro ransomware.
Yara rule that detects dlMarlboro downloader.
Yara rule that detects Marlboro ransomware.
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
This YARA rule detects the ProjectHookPOS infostealer by identifying specific byte sequences (hex patterns) within executable files. The patterns correspond to functions related to calculating Luhn algorithm checksums (often used for credit card validation), reversing track data (common in POS malware for magnetic stripe data), checking validity, encoding and sending stolen data, and creating forms (potentially for data input or exfiltration). The rule requires all seven defined byte sequences to be present in a file that starts with the standard DOS executable magic number (0x5A4D) to trigger a detection.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
This YARA rule detects the Linux-based LuckyJoe ransomware by identifying specific byte patterns within its main call functions and encryption routines. The rule looks for distinct sequences of assembly instructions related to the ransomware's core operations, including file encryption and internal message handling. The condition requires all parts of these identified patterns to be present, along with the ELF magic number, to ensure high fidelity detection of the LuckyJoe executable.
Page 220 of 232