Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
577 detections
Filters
Last updated
All Time
Detection languages
196
156
55
49
35
Contributors
145
118
60
36
31
Categories
379
310
98
54
49
Platforms
517
27
16
14
12
Products / Services
204
185
101
63
48
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
1
IDS Classtypes
3
1
IDS Protocols
1
1
1
This YARA rule detects the Ragnarok ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code sections responsible for finding files, encrypting files, disabling the firewall, and deleting shadow volumes, which are common behaviors of ransomware.
This YARA rule detects the TorrentLocker ransomware by identifying specific byte sequences (signatures) associated with its executable code. These signatures include patterns related to its entry point, functions for contacting command and control servers, retrieving server data, removing shadow copies to prevent recovery, and finding files for encryption. The rule requires a combination of these patterns to trigger, ensuring a higher confidence in detection.
This rule detects the WannaCry ransomware based on specific byte patterns found within the executable. It checks for a valid PE header and then matches a combination of byte sequences at the entry point and various other locations within the binary, indicative of WannaCry's code.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
Yara rule that detects DenizKizi ransomware.
Yara rule that detects Montserrat ransomware.
Yara rule that detects NotPetya ransomware.
Yara rule that detects PXJ ransomware.
Yara rule that detects Ragnarok ransomware.
Yara rule that detects TorrentLocker ransomware.
Page 28 of 28