Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This YARA rule detects the Albabat ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for patterns related to file encryption, dropping a ransom note, changing the desktop wallpaper, and finding files to encrypt. The presence of these combined patterns indicates the likely presence of the Albabat ransomware.
Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)
This Yara rule detects the presence of Cactus ransomware by identifying specific byte patterns associated with its file encryption, file discovery, process checking, and process killing functionalities. The rule looks for distinct sequences of bytes within executable files, indicating the presence of Cactus ransomware components.
Yara rule that detects Cactus ransomware.
This YARA rule detects the BiBiWiper trojan by identifying specific byte sequences associated with its shadow copy deletion and file destruction functionalities. The rule looks for two distinct patterns, '$delete_shadow_copies_p*' and '$destroy_files_p*', which are indicative of the malware's destructive behavior. The presence of both sets of patterns within a file, combined with the MZ header (0x5A4D), triggers the detection.
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)
This YARA rule detects various components and behaviors associated with the BlackBasta ransomware. It identifies specific byte patterns related to file discovery, encryption routines (multiple versions), command prompt execution, LDAP connection attempts, dropping of ransom notes, and exclusion logic for files/volumes from encryption. The rule is designed to catch the ransomware executable itself based on these unique code signatures.
Yara rule that detects BlackBasta ransomware.
Yara rule that detects BlackBasta ransomware.
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
This YARA rule detects the Lorenz ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, scheduled task creation for persistence, and remote connection functionalities. The rule includes two main versions of the ransomware's code, covering different implementations of these malicious activities.
This YARA rule detects the Meow ransomware based on specific byte patterns found in its executable code. The rule looks for patterns associated with file encryption routines, the dropping of a ransom note, and functions used to find files on the system. The condition requires the presence of the MZ header (indicating a Windows executable) and all defined string patterns to match, ensuring a high-fidelity detection of the Meow ransomware.
Yara rule that detects Lorenz ransomware.
Yara rule that detects Meow ransomware.
This rule detects the Moisha ransomware by identifying specific bytecode patterns related to file enumeration, private key importation, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Moisha's operational methodology.
Page 131 of 149