Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the WannaCry ransomware based on specific byte patterns found within the executable. It checks for a valid PE header and then matches a combination of byte sequences at the entry point and various other locations within the binary, indicative of WannaCry's code.
This YARA rule detects the Xorist ransomware family by identifying specific byte patterns associated with its file search, encryption routines, and resource extraction mechanisms. The rule includes two distinct versions of these patterns to cover variations of the malware.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
This YARA rule detects the ZeroCrypt ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for three distinct patterns, `$encrypt_file_1`, `$encrypt_file_2`, and `$encrypt_file_3`, which are characteristic of the ZeroCrypt ransomware's encryption routines. Additionally, it verifies that the file is a Windows executable by checking for the 'MZ' magic bytes (uint16(0) == 0x5A4D).
This YARA rule detects the Zoldon ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include sequences related to the main encryption function, the creation of a specific registry key (likely for persistence or configuration), and functions involved in finding files to encrypt. The rule looks for these distinct code segments within executable files.
This rule detects the Ako ransomware by identifying specific byte patterns (YARA signatures) associated with its file encryption routines, including those targeting local files and network shares. The rule looks for distinct code sequences related to file enumeration and encryption activities, indicating the presence and execution of the Ako ransomware.
This YARA rule detects the SeedLocker ransomware by identifying specific byte sequences ($search_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) within executable files. These sequences are indicative of the ransomware's file searching and encryption routines. The rule requires the presence of a valid MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, ensuring high confidence in detection.
This YARA rule detects the TrickBot trojan by identifying specific byte sequences ($entry_setup, $decrypt_function_snippet, $decrypt_function_snippet_wrapper) commonly found in its executable code. The rule requires the presence of the standard Windows PE magic number (0x5A4D) at the beginning of the file, along with the $entry_setup pattern, and at least one of the decryption function snippets.
This rule detects the Win32_Virus_Awfull malware by identifying a specific byte pattern within the Portable Executable (PE) file's entry point. The rule checks for the presence of the 'MZ' magic bytes (0x5A4D) at the beginning of the file, confirming it's a PE file, and then scans for a unique sequence of bytes ($awfull_body) at the entry point, which is characteristic of the Awfull virus.
This YARA rule detects the Cmay virus by looking for specific byte sequences within the Portable Executable (PE) file. It checks for two distinct bodies of code, '$cmay_body_1' and '$cmay_body_2', with '$cmay_body_1' specifically required to be present at the entry point of the PE file. The rule also verifies that the file starts with the 'MZ' magic bytes (0x5A4D), indicating a valid Windows executable.
This rule detects the 'DeadCode' virus by looking for specific byte sequences at the entry point of a PE file and a unique marker within the file. It checks for four distinct patterns: three at the entry point combined with a marker at offset 0x40, or two specific byte sequences in the body of the file. The rule uses the 'pe' YARA module to identify Portable Executable files and their entry points.
This YARA rule detects the Elerad virus by searching for a specific byte sequence (signature) within the Portable Executable (PE) file, specifically at its entry point. The rule first checks if the file is a valid PE file by verifying the 'MZ' header (0x5A4D at offset 0). If it is a PE file, it then looks for the '$elerad_body' byte pattern at the file's entry point, indicating the presence of the Elerad malware.
This YARA rule detects the Greenp virus by looking for specific byte sequences within the Portable Executable (PE) file. It checks for two distinct bodies of code ($greenp_body_1 and $greenp_body_2) and requires that $greenp_body_1 is present at the entry point of the PE file. The rule also verifies that the file starts with the MZ header (0x5A4D), indicating a valid Windows executable.
This rule detects the Win32_Virus_Negt malware based on specific byte patterns found within the Portable Executable (PE) file. It checks for these patterns either at the entry point of the PE file or across multiple sections of the file, indicating the presence of the Negt virus body and its infector components.
This YARA rule detects the Mocket virus by matching specific byte sequences within the Portable Executable (PE) file. The rule checks for the standard PE magic number (MZ header) and then looks for three distinct byte patterns at the entry point and other locations within the executable. This indicates the presence of the Mocket malware.
Yara rule that detects MultigrainPOS infostealer.
Yara rule that detects ProjectHookPOS infostealer.
Yara rule that detects KillDisk ransomware.
Yara rule that detects LuckyJoe ransomware.
Yara rule that detects 5ss5c ransomware.
Yara rule that detects ASN1Encoder ransomware.
Page 226 of 232