Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Yara rule that detects Lorenz ransomware.
Yara rule that detects Meow ransomware.
This rule detects the Moisha ransomware by identifying specific bytecode patterns related to file enumeration, private key importation, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Moisha's operational methodology.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects Moisha ransomware.
Yara rule that detects GwisinLocker ransomware.
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
This YARA rule detects the RedAlert ransomware by identifying specific byte patterns within the executable. The patterns correspond to functions involved in setting up the environment, finding files to encrypt, encrypting files, and making configuration changes, which are characteristic behaviors of the RedAlert ransomware.
Yara rule that detects RedAlert ransomware.
This YARA rule detects the Acepy ransomware by identifying specific byte patterns associated with its core functionalities: finding files to encrypt, performing the encryption process, and dropping a ransom note. The rule requires all three patterns to be present within a Windows executable file (indicated by the MZ header) to trigger a detection.
This rule detects the BlueLocker ransomware by identifying specific byte patterns related to its file encryption and file finding routines, as well as its cryptographic context creation. The rule looks for three distinct parts of the encryption process ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3), two parts of the file finding process ($find_files_p1, $find_files_p2), and a pattern for creating the cryptographic context ($create_crypt_context). All these patterns must be present for a detection to occur, indicating the presence of the BlueLocker ransomware.
Yara rule that detects Acepy ransomware.
Yara rule that detects BlueLocker ransomware.
This Yara rule detects the PoliceRecords ransomware. It identifies specific byte sequences related to file encryption, file discovery, desktop manipulation (likely for displaying a ransom note or changing wallpaper), and the dropping of a ransom note. The rule looks for these distinct patterns within executable files (identified by the 'MZ' header).
Yara rule that detects PoliceRecords ransomware.
Yara rule that detects WsIR ransomware.
This rule detects the EAF ransomware by identifying specific bytecode patterns associated with its file encryption, file finding, and file destruction functionalities. The rule looks for a combination of patterns related to encrypting files, locating files on the system, and destroying executable files, indicating the presence and activity of the EAF ransomware.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
Yara rule that detects WaspLocker ransomware.
Yara rule that detects Cincoo ransomware.
Yara rule that detects FarAttack ransomware.
Page 132 of 149