Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,438
11,829
5,872
5,150
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the Gibon ransomware by identifying specific byte patterns related to remote server connections and encryption loops within executable files. The rule requires the presence of a standard Windows PE header (MZ) and a combination of byte sequences indicative of Gibon's network communication and file encryption routines.
This YARA rule detects the GlobeImposter ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and process termination functions. The rule looks for combinations of these patterns within executable files to increase detection accuracy.
This YARA rule detects the GPCode ransomware by identifying specific byte sequences related to its core functionalities. These include patterns for iterating through drives, the encryption routine itself, setting a ransomware wallpaper, and reading configuration files. The rule requires all four byte patterns to be present within a file that starts with the MZ header (indicating a Windows executable) to trigger a detection.
This rule detects the 'Good' ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the HDDCryptor ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include deploying components, gathering share information, encrypting disks, creating a DiskCryptor service, extracting DiskCryptor from resources, encrypting files, and initiating a system reboot. The rule looks for combinations of these patterns to ensure high confidence in detection.
This YARA rule detects the HDMR ransomware by identifying specific byte patterns associated with its file finding, encryption, and backup targeting functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the HDMR ransomware's code for locating files, encrypting them, and specifically targeting Microsoft Exchange backups.
This YARA rule detects the Hermes ransomware by identifying specific byte patterns associated with its file finding, encryption, and resource enumeration routines. The rule includes patterns for two different versions of Hermes ransomware, ensuring detection across variations of the malware. It specifically looks for the presence of a Windows executable (MZ header) and then checks for the unique byte sequences related to Hermes's operational functions.
This YARA rule detects the HydraCrypt ransomware by identifying specific byte patterns associated with its file encryption routines and remote connection capabilities. The rule looks for two distinct sets of patterns, each combining multiple encryption-related and remote connection-related byte sequences, indicating the presence of the ransomware.
This YARA rule detects the IFN643 ransomware by identifying specific byte patterns associated with its code. The rule looks for a Windows executable (MZ header) and then matches three distinct byte sequences, likely corresponding to its file searching and encryption functionalities. The rule's primary purpose is to identify the presence of this specific ransomware variant on a system.
This YARA rule detects the JSWorm ransomware by identifying specific byte patterns associated with its file finding, drive enumeration, and file encryption routines. The rule looks for a combination of these patterns within executable files (MZ header check).
This YARA rule detects the Jamper ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential Jamper ransomware samples.
This YARA rule detects the Jemd ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences of bytes associated with file finding routines, file encryption routines (split into two parts), and a main routine, indicating the presence of the Jemd ransomware.
This YARA rule detects the Kangaroo ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes (hex patterns) that are characteristic of the Kangaroo ransomware's code for encrypting files, locating files on the system, and enumerating resources.
This YARA rule detects the KillDisk ransomware based on specific byte patterns found in its executable code. It looks for patterns related to file encryption routines and application whitelisting mechanisms, which are characteristic of KillDisk variants. The rule requires all three defined string patterns to be present in a PE file (indicated by the 'MZ' header) for a match.
This YARA rule detects the Kovter ransomware based on specific byte sequences found within the malware's executable. It looks for patterns related to remote connection functionalities, file enumeration, and payload decryption scripts, which are characteristic of Kovter's operation. The rule requires all identified string patterns to be present, along with a check for the MZ header (uint16(0) == 0x5A4D), indicating a Windows executable.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
This YARA rule detects the Ladon ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of Ladon ransomware.
This rule detects the LeChiffre ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule requires all identified patterns to be present in a file to trigger, indicating a high confidence detection for this specific ransomware.
This rule detects the LooCipher ransomware by identifying specific byte patterns associated with its functionality. The patterns include code related to establishing remote connections, encrypting files, and finding files on the system. The rule requires all three patterns to be present in an executable file (MZ header) to trigger, aiming to reduce false positives.
This rule detects the MZP ransomware based on a combination of unique byte patterns found within its executable code. Specifically, it looks for patterns related to showing a ransom note, searching for configuration files, tracking mouse events (potentially for entropy generation or anti-analysis), finding files to encrypt, and the encryption routines themselves. The rule requires all these distinct code segments to be present, indicating a high confidence detection for MZP ransomware.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
Page 223 of 232