Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,437
11,828
5,871
5,150
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the CryptoLocker ransomware by identifying specific byte sequences (strings) associated with its file looping, data encryption, and data decryption routines. The rule looks for combinations of these patterns within executable files (identified by the 'MZ' header) to increase accuracy.
This YARA rule detects various versions of the CryptoWall ransomware based on specific byte patterns found at the entry point and within API loading, hash calculation, file finding, and file encryption routines. It targets both version 2.0 and 3.0 variants of the ransomware by looking for distinct code sequences indicative of their malicious functionality.
This YARA rule detects the Crysis ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code related to remote connections, file enumeration, resource enumeration, and file encryption, which are characteristic behaviors of ransomware.
This rule detects the Cuba ransomware based on specific byte patterns found within the executable. The patterns are associated with functions for enumerating resources, finding files, and encrypting files, which are characteristic behaviors of ransomware.
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This YARA rule detects the DMR ransomware by identifying specific byte patterns associated with its file discovery and encryption routines. The rule looks for distinct code segments that are characteristic of how this ransomware locates files on a system and subsequently encrypts them.
This rule detects the Defray ransomware by identifying specific byte patterns related to its file finding, special folder enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file to indicate the presence of Defray ransomware.
This YARA rule detects the Delphimorix ransomware by identifying specific byte sequences (patterns) associated with its file encryption and file finding routines. The rule looks for a combination of these patterns within a file, along with the MZ header (0x5A4D) indicating a Windows executable.
This rule detects the DenizKizi ransomware by identifying specific byte patterns associated with its file finding, file encryption, and shadow copy deletion routines. The rule requires all three sets of byte patterns to be present in a file for a match, reducing false positives.
This Yara rule detects the DesuCrypt ransomware by identifying specific byte patterns associated with its file enumeration, encryption, and network share discovery functionalities. The rule looks for three distinct sets of byte sequences, all of which must be present in a file for a detection to occur. These patterns likely correspond to core functions within the ransomware's executable code.
This rule detects the Dharma ransomware based on specific byte patterns found within the executable. The patterns indicate functionalities related to file searching, encryption routines, and enumeration of network shares, which are characteristic behaviors of Dharma ransomware.
This YARA rule detects the DirtyDecrypt ransomware by identifying specific byte patterns (signatures) within the executable. The rule looks for a combination of patterns related to entry point code, hashing functions, key management (get, destroy, import), and encryption/decryption routines, as well as a specific pattern named 'mrwhite'. The presence of these combined patterns indicates the file is likely the DirtyDecrypt ransomware.
This rule detects the District ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential District ransomware samples.
This Yara rule detects the Erica ransomware based on specific byte patterns found within its executable code. The rule looks for patterns associated with file encryption routines and file discovery mechanisms, indicating the presence of the Erica ransomware.
This Yara rule detects the FCT ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of patterns related to how the ransomware locates files on a system and subsequently encrypts them. The `uint16(0) == 0x5A4D` condition ensures that the rule only applies to valid Windows executable files (MZ header).
This YARA rule detects the FLKR ransomware based on specific byte patterns found within its executable code. The rule uses three distinct byte sequences ($search_and_encrypt_p1, $search_and_encrypt_p2, $search_and_encrypt_p3) that are characteristic of the ransomware's search and encryption routines. The condition `uint16(0) == 0x5A4D` ensures that the scanned file is a valid Windows executable (MZ header), and `all of ($search_and_encrypt_p*)` requires all three byte patterns to be present for a match, reducing false positives.
This YARA rule detects the FenixLocker ransomware by identifying specific byte sequences ($encrypt_files_1, $encrypt_files_2, $encrypt_files_3, $encrypt_files_4, $encrypt_files_5) within executable files. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) indicating a Windows executable, along with a combination of these byte sequences to trigger. The identified byte sequences are indicative of the ransomware's file encryption routines.
This Yara rule detects the Ferrlock ransomware based on specific byte sequences found within its executable code. The rule looks for patterns related to file searching, resource enumeration, test file creation, and file encryption, indicating the presence of the Ferrlock ransomware.
This YARA rule detects the GPGQwerty ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences related to file enumeration (find_files_p1 and find_files_p2) and a third set related to file encryption (encrypt_files). All identified patterns must be present in a file that starts with the 'MZ' header (uint16(0) == 0x5A4D) to trigger a detection.
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
This YARA rule detects the GarrantyDecrypt ransomware by identifying specific byte patterns associated with its file encryption and file finding functionalities. The rule looks for a valid PE header (MZ magic bytes) and then checks for the presence of three distinct byte sequences: one related to finding files and two related to encrypting files. These patterns are indicative of the ransomware's core operations.
Page 222 of 232