Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This YARA rule detects the Ryuk ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p*, $find_files_p*, $remote_connection) that are characteristic of Ryuk's malicious operations. The rule requires all parts of the encryption and file finding patterns, as well as the remote connection pattern, to be present for a match.
This rule detects the Sage ransomware by identifying specific byte patterns associated with its core functionalities: establishing remote connections, encrypting files, and finding files to encrypt. The rule requires all three patterns to be present within a file to trigger, reducing false positives.
This YARA rule detects the Satan ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, searching for processes, encrypting files, and searching for files in specific folders. The rule combines these patterns to increase confidence in detection.
This YARA rule detects the Satana ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p1, $encrypt_files_p2) indicative of how the ransomware encrypts files, patterns related to how it searches for files ($search_files_p1, $search_files_p2), and byte sequences involved in establishing remote connections ($remote_connection). The rule requires the presence of the remote connection patterns, along with all file searching and file encryption patterns, to trigger a detection, ensuring a high confidence in identifying Satana ransomware.
This rule detects the Serpent ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to DLL manipulation and thread creation, file enumeration and searching, and establishing remote connections, including FTP. The rule specifically targets the Serpent ransomware family.
This YARA rule detects the TeleCrypt ransomware by identifying specific byte patterns related to its file encryption routines, server communication mechanisms, payload execution, and payload copying functions. The rule looks for a combination of these patterns to ensure high confidence in detection. Specifically, it checks for patterns associated with generating strings for encryption, the encryption process itself, communication with a command and control server, executing the ransomware payload, and copying the payload.
Page 246 of 246