Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,124 detections
Filters
Last updated
All Time
Detection languages
1,063
796
474
242
137
Contributors
463
427
399
318
291
Categories
927
772
637
574
311
Platforms
2,113
365
219
214
142
Products / Services
488
482
389
167
150
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
3,124
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.
Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Amazon GuardDuty detects a Denial of Service (DoS) activity in an Amazon EC2 instance.
Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
Detect when multiple GCP Service APIs are disabled in a short period of time.
Detects exploitation attempts of CVE-2024-49113, known as LDAP Nightmare. This rule specifically looks for "Application Error" events (EventID 1000) where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". This combination indicates a crash in the Local Security Authority Subsystem Service (LSASS) related to the Windows Lightweight Directory Access Protocol (LDAP) client library, which is consistent with the described vulnerability exploitation.
Yara rule that detects Helldown ransomware.
This rule detects highly relevant antivirus events in the Windows Application log by looking for specific keywords associated with known virus signatures, malware, and offensive security tools. It aims to identify instances where an antivirus product has detected or quarantined malicious software or activity.
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
This Yara rule detects the CyberVolk ransomware by identifying specific byte patterns within its 'manage_gui', 'find_files', and 'encrypt_files' functions. The rule looks for two distinct versions of the 'find_files' and 'encrypt_files' functions, indicating variations in the ransomware's implementation. The presence of these patterns suggests the file is a CyberVolk ransomware executable.
Yara rule that detects CyberVolk ransomware.
Detects suspicious DNS queries to known Monero mining pools, indicating potential cryptocurrency mining activity on the network. This rule identifies specific domain names associated with various Monero mining operations.
Detects suspicious DNS queries to Monero mining pools
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
This rule detects when the 'RstrtMgr.dll' (Restart Manager) library is loaded by a process that is not part of the common legitimate Windows processes or typical software installation paths. Adversaries, particularly ransomware and wiper malware, have been observed using this DLL to terminate processes that might interfere with their operations, such as file encryption or data destruction. This can include killing processes that lock files, preventing encryption, or for anti-analysis purposes.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Yara rule that detects Cicada3301 ransomware.
Page 122 of 149