Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This Yara rule detects the DesuCrypt ransomware by identifying specific byte patterns associated with its file enumeration, encryption, and network share discovery functionalities. The rule looks for three distinct sets of byte sequences, all of which must be present in a file for a detection to occur. These patterns likely correspond to core functions within the ransomware's executable code.
This rule detects the District ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential District ransomware samples.
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
This YARA rule detects the HDMR ransomware by identifying specific byte patterns associated with its file finding, encryption, and backup targeting functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the HDMR ransomware's code for locating files, encrypting them, and specifically targeting Microsoft Exchange backups.
This YARA rule detects the Jamper ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential Jamper ransomware samples.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
This YARA rule detects the Matsnu ransomware based on specific byte sequences indicative of its functionality. The rule looks for patterns related to remote connections, file encryption routines, and file enumeration, suggesting the presence of the Matsnu ransomware.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This Yara rule detects the Ransoc ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include scanning for services, establishing remote connections, finding files to encrypt, and performing file encryption. The rule looks for distinct sequences of assembly instructions that are characteristic of Ransoc's operational methods.
This YARA rule detects the Satan ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, searching for processes, encrypting files, and searching for files in specific folders. The rule combines these patterns to increase confidence in detection.
This YARA rule detects the TorrentLocker ransomware by identifying specific byte sequences (signatures) associated with its executable code. These signatures include patterns related to its entry point, functions for contacting command and control servers, retrieving server data, removing shadow copies to prevent recovery, and finding files for encryption. The rule requires a combination of these patterns to trigger, ensuring a higher confidence in detection.
This YARA rule detects the Velso ransomware by identifying specific byte sequences (patterns) associated with its file enumeration, resource enumeration, and file encryption routines. The rule looks for distinct code blocks within the malware that are characteristic of how Velso operates to find files, enumerate system resources, and encrypt data.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
This rule detects the Ako ransomware by identifying specific byte patterns (YARA signatures) associated with its file encryption routines, including those targeting local files and network shares. The rule looks for distinct code sequences related to file enumeration and encryption activities, indicating the presence and execution of the Ako ransomware.
Yara rule that detects ASN1Encoder ransomware.
Yara rule that detects Afrodita ransomware.
Yara rule that detects Armage ransomware.
Yara rule that detects BitCrypt ransomware.
Yara rule that detects Blitzkrieg ransomware.
Yara rule that detects Clop ransomware.
Page 201 of 203