Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
This YARA rule detects the Prometey ransomware based on specific byte patterns found in its executable code. The patterns indicate functionality related to remote connections, file discovery, and file encryption, which are characteristic behaviors of ransomware.
This rule detects the Curator ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file, indicating the presence of the ransomware.
This YARA rule detects the Seth ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Knot ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes that are characteristic of how Knot ransomware encrypts files, finds target files on a system, and establishes remote connections, indicating the presence and activity of this specific malware.
This YARA rule detects the AnteFrigus ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files on the system, encrypting files, and establishing remote connections, likely for command and control or data exfiltration. The rule also checks for the standard Windows executable 'MZ' header.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
This Yara rule detects the Plague17 ransomware by identifying specific byte sequences associated with its file finding, file encryption, and remote connection functionalities. The rule looks for distinct patterns in the malware's code related to these core ransomware behaviors.
This YARA rule detects the WinWord64 ransomware by identifying specific byte patterns related to remote connections, file encryption routines, and file discovery mechanisms. The rule looks for a combination of these patterns within a PE file (indicated by 'uint16(0) == 0x5A4D' for 'MZ' header). The 'remote_connection_p*' strings suggest network communication capabilities, while 'encrypt_files_p*' strings indicate file encryption functionality, and 'find_files' points to file enumeration or discovery.
This YARA rule detects the 'Major' ransomware by identifying specific byte patterns related to file enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a Windows executable (MZ header).
This YARA rule detects the Avaddon ransomware by identifying specific byte sequences related to its file finding, encryption, resource enumeration, and remote connection functionalities. The rule looks for a combination of these distinct patterns within a file, indicating the presence of Avaddon ransomware.
This YARA rule detects the Sifreli ransomware by identifying specific byte patterns related to file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to classify it as Sifreli ransomware.
This rule detects the 5ss5c ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
This YARA rule detects the ASN1Encoder ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of patterns indicative of ransomware behavior, including functions for finding files, encrypting them, and establishing remote connections, all within a Windows executable (MZ header check).
This YARA rule detects the Buran ransomware by identifying specific byte patterns related to file enumeration, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This rule detects the CryptoBit ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This rule detects the Defray ransomware by identifying specific byte patterns related to its file finding, special folder enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file to indicate the presence of Defray ransomware.
This rule detects the 'Good' ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the Ladon ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of Ladon ransomware.
Page 296 of 297