Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This YARA rule detects the RetMyData ransomware by identifying specific byte sequences ($find_files, $enum_resources, $encrypt_files) within executable files. These sequences are indicative of the ransomware's functionality related to finding files, enumerating resources, and encrypting files. The rule requires all three byte sequences to be present in a PE (Portable Executable) file to trigger a detection.
This YARA rule detects the Revil ransomware by identifying specific byte patterns associated with its file searching, encryption, remote connection, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within executable files that are characteristic of Revil's operations, including functions for searching files to encrypt, performing the encryption itself, establishing remote connections (likely for command and control or data exfiltration), and enumerating system resources.
This YARA rule detects the Rokku ransomware by identifying specific byte patterns associated with its file encryption, file finding, and folder finding functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the Rokku ransomware's code for these operations. The condition requires the presence of the standard Windows executable MZ header (0x5A4D) and all defined byte patterns for finding folders, finding files, and encrypting files.
This YARA rule detects the Ryuk ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p*, $find_files_p*, $remote_connection) that are characteristic of Ryuk's malicious operations. The rule requires all parts of the encryption and file finding patterns, as well as the remote connection pattern, to be present for a match.
This rule detects the Sage ransomware by identifying specific byte patterns associated with its core functionalities: establishing remote connections, encrypting files, and finding files to encrypt. The rule requires all three patterns to be present within a file to trigger, reducing false positives.
This YARA rule detects the Satan ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, searching for processes, encrypting files, and searching for files in specific folders. The rule combines these patterns to increase confidence in detection.
This YARA rule detects the Satana ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p1, $encrypt_files_p2) indicative of how the ransomware encrypts files, patterns related to how it searches for files ($search_files_p1, $search_files_p2), and byte sequences involved in establishing remote connections ($remote_connection). The rule requires the presence of the remote connection patterns, along with all file searching and file encryption patterns, to trigger a detection, ensuring a high confidence in identifying Satana ransomware.
This YARA rule detects the Sepsis ransomware by identifying specific byte sequences related to its file searching and encryption routines. The rule looks for distinct patterns in the executable code that are characteristic of Sepsis ransomware's functionality.
This rule detects the Serpent ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to DLL manipulation and thread creation, file enumeration and searching, and establishing remote connections, including FTP. The rule specifically targets the Serpent ransomware family.
This rule detects the SevenSevenSeven ransomware based on specific byte patterns found within the executable. It looks for distinct code sequences related to file searching, encryption routines, and remote server communication, which are characteristic of this particular ransomware family. The rule requires the presence of all file search patterns and a combination of either the first set of encryption and remote server patterns or the second set.
This YARA rule detects the Sherminator ransomware by identifying specific byte patterns associated with its resource enumeration, file finding, and file encryption functions. The rule looks for distinct sequences of bytes within the executable, indicating the presence of Sherminator's core malicious functionalities. The condition `uint16(0) == 0x5A4D` ensures that the rule only applies to valid Windows Portable Executable (PE) files.
This rule detects the Sifrelendi ransomware based on specific byte patterns found within the executable. The rule looks for two distinct sets of byte sequences, '$search_files' and '$encrypt_files', which are indicative of the ransomware's file searching and encryption routines. The rule also verifies that the file is a Windows executable by checking for the 'MZ' header (uint16(0) == 0x5A4D).
This YARA rule detects the Sigrun ransomware by identifying specific byte patterns associated with its file enumeration and encryption routines. The rule looks for a combination of patterns related to finding files, encrypting files (three distinct sets of patterns), and enumerating resources (two distinct sets of patterns). All identified patterns must be present for a match, along with the standard PE file magic number (MZ header).
This Yara rule detects the Spora ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include routines for encrypting files, creating key files, generating encryption keys, and enumerating resources on the system. The rule looks for a combination of these patterns to ensure high confidence in detection.
This YARA rule detects the TBLocker ransomware by identifying specific byte patterns within the executable. It looks for distinct sequences of bytes associated with the ransomware's main functions, including those responsible for searching and encrypting files. The rule requires all parts of the main ransomware function patterns, along with the file search and encryption patterns, to be present in a PE (Portable Executable) file (indicated by `uint16(0) == 0x5A4D`) to trigger a detection.
This YARA rule detects the TeleCrypt ransomware by identifying specific byte patterns related to its file encryption routines, server communication mechanisms, payload execution, and payload copying functions. The rule looks for a combination of these patterns to ensure high confidence in detection. Specifically, it checks for patterns associated with generating strings for encryption, the encryption process itself, communication with a command and control server, executing the ransomware payload, and copying the payload.
This YARA rule detects various versions of the Teslacrypt ransomware based on specific byte patterns found within the executable files. The rule is composed of multiple logical blocks, each targeting different versions or components of Teslacrypt, including file search, encryption routines, and server communication modules. The presence of these byte sequences indicates that a file is likely a Teslacrypt ransomware variant.
This YARA rule detects the TorrentLocker ransomware by identifying specific byte sequences (signatures) associated with its executable code. These signatures include patterns related to its entry point, functions for contacting command and control servers, retrieving server data, removing shadow copies to prevent recovery, and finding files for encryption. The rule requires a combination of these patterns to trigger, ensuring a higher confidence in detection.
This YARA rule detects the VHDLocker ransomware by identifying specific byte patterns (strings) associated with its file encryption routines, logical drive enumeration, and file finding mechanisms. The rule requires all three sets of patterns to be present in a file to trigger, indicating a high confidence detection for the VHDLocker malware.
This YARA rule detects the VegaLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of byte sequences that are characteristic of how VegaLocker operates, specifically in functions related to locating files and encrypting them. The presence of these patterns indicates the likely presence of the VegaLocker ransomware.
This YARA rule detects the Velso ransomware by identifying specific byte sequences (patterns) associated with its file enumeration, resource enumeration, and file encryption routines. The rule looks for distinct code blocks within the malware that are characteristic of how Velso operates to find files, enumerate system resources, and encrypt data.
Page 225 of 232