Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Yara rule that detects HarpoonLocker ransomware.
This rule detects the Redeemer ransomware by identifying specific byte patterns associated with its file discovery, encryption routines, and process modification activities. The rule looks for a combination of these patterns within a PE file to confirm the presence of Redeemer ransomware.
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
Yara rule that detects Redeemer ransomware.
Yara rule that detects Rook ransomware.
This Yara rule detects the Janelle ransomware by identifying specific bytecode patterns associated with its setup environment, file finding mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of how Janelle ransomware initializes itself, locates target files, and performs encryption.
Yara rule that detects Janelle ransomware.
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
This rule detects the DST ransomware by identifying specific byte patterns associated with its core functionalities: encrypting files, finding files to encrypt, and killing processes. The rule looks for distinct sequences of assembly instructions (byte patterns) that are characteristic of how DST ransomware operates. Specifically, it requires all three sets of patterns related to file encryption, file discovery, and process termination to be present within a file to trigger a detection. The rule also checks for the standard Windows executable MZ header (0x5A4D) to ensure it's analyzing a valid executable.
Yara rule that detects TimeCrypt ransomware.
Yara rule that detects DST ransomware.
This YARA rule detects the HotCoffee ransomware. It identifies specific byte patterns related to the ransomware's functionality, including enumerating drives, finding files, encrypting files, and dropping a ransom note. The rule looks for a combination of these patterns to ensure high confidence in detection.
Yara rule that detects Apis ransomware.
Yara rule that detects HotCoffee ransomware.
This YARA rule detects the Invert ransomware by identifying specific byte sequences related to its file encryption, file finding, and file listing functionalities. The rule looks for distinct patterns in the compiled bytecode that are characteristic of the Invert ransomware's operations.
Yara rule that detects Invert ransomware.
Yara rule that detects Sanwai ransomware.
This rule detects the Solaso ransomware by identifying specific byte patterns related to its file finding and encryption routines. The rule looks for distinct sequences of bytes within the executable, indicating the presence of Solaso ransomware.
This rule detects the Wintenzz ransomware by identifying specific byte patterns related to its file finding, encryption, and ransom note dropping functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects Solaso ransomware.
Yara rule that detects Wintenzz ransomware.
Page 134 of 149