Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This YARA rule detects the ASN1Encoder ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of patterns indicative of ransomware behavior, including functions for finding files, encrypting them, and establishing remote connections, all within a Windows executable (MZ header check).
This YARA rule detects the Atlas ransomware by identifying specific byte patterns related to file encryption routines and network communication patterns, including sending POST and GET requests to remote servers. The rule looks for a combination of these patterns to minimize false positives.
This YARA rule detects the BadBlock ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for three distinct sets of byte sequences: one related to encrypting files, another for searching files, and a third for establishing remote connections. All three patterns must be present in a file, along with the MZ header (0x5A4D), for a detection to occur.
This YARA rule detects the Buran ransomware by identifying specific byte patterns related to file enumeration, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This rule detects the CryptoBit ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Crysis ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code related to remote connections, file enumeration, resource enumeration, and file encryption, which are characteristic behaviors of ransomware.
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This rule detects the Defray ransomware by identifying specific byte patterns related to its file finding, special folder enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file to indicate the presence of Defray ransomware.
This rule detects the 'Good' ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the HydraCrypt ransomware by identifying specific byte patterns associated with its file encryption routines and remote connection capabilities. The rule looks for two distinct sets of patterns, each combining multiple encryption-related and remote connection-related byte sequences, indicating the presence of the ransomware.
This YARA rule detects the Ladon ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of Ladon ransomware.
This rule detects the LeChiffre ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule requires all identified patterns to be present in a file to trigger, indicating a high confidence detection for this specific ransomware.
This rule detects the LooCipher ransomware by identifying specific byte patterns associated with its functionality. The patterns include code related to establishing remote connections, encrypting files, and finding files on the system. The rule requires all three patterns to be present in an executable file (MZ header) to trigger, aiming to reduce false positives.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
This YARA rule detects the Matsnu ransomware based on specific byte sequences indicative of its functionality. The rule looks for patterns related to remote connections, file encryption routines, and file enumeration, suggesting the presence of the Matsnu ransomware.
This YARA rule detects the MarsJoke ransomware by identifying specific byte patterns related to its file search and encryption routines, as well as patterns associated with its remote connection capabilities. The rule combines three distinct byte signatures to increase accuracy.
This YARA rule detects the Nemty ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The patterns are associated with Nemty's functionalities, including remote connection capabilities, enumeration of resources, file finding operations, and file encryption routines. The rule requires all defined string patterns to be present in a file that starts with the 'MZ' magic bytes (0x5A4D) to trigger a detection.
This rule detects the Paradise ransomware by identifying specific byte patterns associated with its file searching, encryption routines, and HTTP remote connection capabilities. The rule requires the presence of a PE header (MZ signature) and all specified string patterns to trigger, indicating a high confidence detection of the Paradise ransomware executable.
This YARA rule detects the PrincessLocker ransomware by identifying specific byte sequences associated with its file encryption routines and remote connection functionalities. The rule looks for three distinct patterns: one related to file encryption operations and two related to establishing remote connections. All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
This Yara rule detects the Ransoc ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include scanning for services, establishing remote connections, finding files to encrypt, and performing file encryption. The rule looks for distinct sequences of assembly instructions that are characteristic of Ransoc's operational methods.
This YARA rule detects the Revil ransomware by identifying specific byte patterns associated with its file searching, encryption, remote connection, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within executable files that are characteristic of Revil's operations, including functions for searching files to encrypt, performing the encryption itself, establishing remote connections (likely for command and control or data exfiltration), and enumerating system resources.
Page 245 of 246