Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This Yara rule detects the Povlsomware ransomware. It identifies specific bytecode patterns associated with the ransomware's setup, file discovery, and encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file (indicated by the 'MZ' header).
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
This YARA rule detects the CobraLocker ransomware by identifying specific bytecode patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns in the `encrypt_files` and `find_files` sections, along with checking for the MZ header (uint16(0) == 0x5A4D) to ensure it's an executable.
Yara rule that detects Dusk ransomware.
Yara rule that detects Fantom ransomware.
Yara rule that detects GhosTEncryptor ransomware.
Yara rule that detects Namaste ransomware.
Yara rule that detects Oct ransomware.
Yara rule that detects Pacman ransomware.
Yara rule that detects Povlsomware ransomware.
Yara rule that detects Retis ransomware.
Yara rule that detects Thanos ransomware.
Yara rule that detects WildFire ransomware.
Yara rule that detects WormLocker ransomware.
Yara rule that detects CobraLocker ransomware.
Yara rule that detects Networm ransomware.
Yara rule that detects WhiteBlackCrypt ransomware.
This YARA rule detects the HowAreYou ransomware based on specific byte patterns associated with its remote connection capabilities, file discovery mechanisms, and file encryption routines. The rule looks for distinct sequences of bytes that are characteristic of the malware's code for establishing remote connections, enumerating files on the system, and performing encryption of those files.
Yara rule that detects Henry ransomware.
Page 136 of 149