Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
Detects the deletion of backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects the deletion of all backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)
This Yara rule detects the presence of Cactus ransomware by identifying specific byte patterns associated with its file encryption, file discovery, process checking, and process killing functionalities. The rule looks for distinct sequences of bytes within executable files, indicating the presence of Cactus ransomware components.
This YARA rule detects the BiBiWiper trojan by identifying specific byte sequences associated with its shadow copy deletion and file destruction functionalities. The rule looks for two distinct patterns, '$delete_shadow_copies_p*' and '$destroy_files_p*', which are indicative of the malware's destructive behavior. The presence of both sets of patterns within a file, combined with the MZ header (0x5A4D), triggers the detection.
Yara rule that detects BiBiWiper trojan.
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
This YARA rule detects the Acepy ransomware by identifying specific byte patterns associated with its core functionalities: finding files to encrypt, performing the encryption process, and dropping a ransom note. The rule requires all three patterns to be present within a Windows executable file (indicated by the MZ header) to trigger a detection.
This rule detects the TimeTime ransomware by identifying specific bytecode patterns associated with its file enumeration, encryption, and renaming activities. The rule looks for distinct sequences of operations related to finding files, encrypting files, encrypting folders, and renaming files, which are characteristic behaviors of ransomware.
This YARA rule detects the HarpoonLocker ransomware by identifying specific bytecode patterns related to file encryption, file discovery, and boot modification. The rule looks for distinct sequences of opcodes and operands that are characteristic of how HarpoonLocker encrypts files, finds target files on a system, and attempts to alter boot configurations for persistence or impact.
This rule detects the DST ransomware by identifying specific byte patterns associated with its core functionalities: encrypting files, finding files to encrypt, and killing processes. The rule looks for distinct sequences of assembly instructions (byte patterns) that are characteristic of how DST ransomware operates. Specifically, it requires all three sets of patterns related to file encryption, file discovery, and process termination to be present within a file to trigger a detection. The rule also checks for the standard Windows executable MZ header (0x5A4D) to ensure it's analyzing a valid executable.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
This YARA rule detects the GlobeImposter ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and process termination functions. The rule looks for combinations of these patterns within executable files to increase detection accuracy.
This YARA rule detects the GPCode ransomware by identifying specific byte sequences related to its core functionalities. These include patterns for iterating through drives, the encryption routine itself, setting a ransomware wallpaper, and reading configuration files. The rule requires all four byte patterns to be present within a file that starts with the MZ header (indicating a Windows executable) to trigger a detection.
This YARA rule detects the HDDCryptor ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include deploying components, gathering share information, encrypting disks, creating a DiskCryptor service, extracting DiskCryptor from resources, encrypting files, and initiating a system reboot. The rule looks for combinations of these patterns to ensure high confidence in detection.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This rule detects the Montserrat ransomware based on specific byte patterns associated with its file finding, encryption, and service shutdown routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
This YARA rule detects the PXJ ransomware based on specific byte patterns associated with its file finding, file encryption, and volume snapshot deletion functionalities. The rule looks for distinct sequences of bytes that are characteristic of the PXJ ransomware's code, indicating its presence in a binary.
Page 27 of 28