Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This rule detects the Networm ransomware by identifying specific byte patterns associated with its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
This YARA rule detects the Prometey ransomware based on specific byte patterns found in its executable code. The patterns indicate functionality related to remote connections, file discovery, and file encryption, which are characteristic behaviors of ransomware.
This rule detects the Curator ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file, indicating the presence of the ransomware.
This YARA rule detects the Pay2Key ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
This YARA rule detects the Seth ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Knot ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes that are characteristic of how Knot ransomware encrypts files, finds target files on a system, and establishes remote connections, indicating the presence and activity of this specific malware.
This YARA rule detects the AnteFrigus ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files on the system, encrypting files, and establishing remote connections, likely for command and control or data exfiltration. The rule also checks for the standard Windows executable 'MZ' header.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
This Yara rule detects the Plague17 ransomware by identifying specific byte sequences associated with its file finding, file encryption, and remote connection functionalities. The rule looks for distinct patterns in the malware's code related to these core ransomware behaviors.
This YARA rule detects the WinWord64 ransomware by identifying specific byte patterns related to remote connections, file encryption routines, and file discovery mechanisms. The rule looks for a combination of these patterns within a PE file (indicated by 'uint16(0) == 0x5A4D' for 'MZ' header). The 'remote_connection_p*' strings suggest network communication capabilities, while 'encrypt_files_p*' strings indicate file encryption functionality, and 'find_files' points to file enumeration or discovery.
This YARA rule detects the 'Major' ransomware by identifying specific byte patterns related to file enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a Windows executable (MZ header).
This YARA rule detects the Ransomexx ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file to confirm the presence of Ransomexx.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
This YARA rule detects the Avaddon ransomware by identifying specific byte sequences related to its file finding, encryption, resource enumeration, and remote connection functionalities. The rule looks for a combination of these distinct patterns within a file, indicating the presence of Avaddon ransomware.
This YARA rule detects the Sifreli ransomware by identifying specific byte patterns related to file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to classify it as Sifreli ransomware.
This YARA rule detects the KawaiiLocker ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences related to file searching, remote connections, and file encryption routines, indicating the presence and functionality of the KawaiiLocker ransomware.
This YARA rule detects the Alcatraz ransomware by identifying specific byte patterns associated with its file encryption routines and its communication with remote servers. The rule looks for three distinct byte sequences: one related to file encryption logic ($encrypt_files) and two others related to remote server communication ($remote_server and $remote_server_2). All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
This YARA rule detects the Marlboro ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with network communication (pinging APNIC, remote server connections) and file encryption routines. The presence of these combined patterns indicates the likely presence of the Marlboro ransomware.
This rule detects the 5ss5c ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
Page 244 of 246