Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
This Yara rule detects the Magniber ransomware by identifying specific byte patterns related to its remote connection capabilities, file encryption routines, and file search mechanisms. The rule looks for a combination of these patterns to ensure high confidence in detection.
This rule detects the Maktub ransomware based on specific byte patterns found within the executable. It looks for distinct sequences of bytes associated with file encryption and file searching functionalities characteristic of Maktub ransomware.
This YARA rule detects the Matsnu ransomware based on specific byte sequences indicative of its functionality. The rule looks for patterns related to remote connections, file encryption routines, and file enumeration, suggesting the presence of the Matsnu ransomware.
This YARA rule detects the MarsJoke ransomware by identifying specific byte patterns related to its file search and encryption routines, as well as patterns associated with its remote connection capabilities. The rule combines three distinct byte signatures to increase accuracy.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This rule detects the Montserrat ransomware based on specific byte patterns associated with its file finding, encryption, and service shutdown routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
This rule detects the NanoLocker ransomware based on specific byte patterns found within its executable code. The patterns are associated with functions responsible for file encryption, communication with remote servers, and enumeration of shares for encryption. The rule requires all five defined byte patterns to be present in a PE file (identified by the 'MZ' header) to trigger, aiming to reduce false positives.
This YARA rule detects the Nefilim ransomware by identifying specific byte patterns related to its encryption routines. The rule looks for patterns associated with creating encryption keys, encrypting encryption keys, and multiple parts of the file encryption process, as well as patterns for finding files to encrypt. The rule also checks for the standard Windows PE header (MZ).
This YARA rule detects the Nemty ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The patterns are associated with Nemty's functionalities, including remote connection capabilities, enumeration of resources, file finding operations, and file encryption routines. The rule requires all defined string patterns to be present in a file that starts with the 'MZ' magic bytes (0x5A4D) to trigger a detection.
This YARA rule detects the NotPetya ransomware by identifying specific byte sequences (patterns) associated with its file encryption routine, main execution logic, encryption loop, and system shutdown/reboot mechanisms. The rule requires all four distinct byte patterns to be present within a file, along with the standard Windows PE header (MZ magic bytes), to trigger a detection. This combination of patterns aims to specifically identify NotPetya samples.
This rule detects the Ouroboros ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This YARA rule detects the PXJ ransomware based on specific byte patterns associated with its file finding, file encryption, and volume snapshot deletion functionalities. The rule looks for distinct sequences of bytes that are characteristic of the PXJ ransomware's code, indicating its presence in a binary.
This rule detects the Paradise ransomware by identifying specific byte patterns associated with its file searching, encryption routines, and HTTP remote connection capabilities. The rule requires the presence of a PE header (MZ signature) and all specified string patterns to trigger, indicating a high confidence detection of the Paradise ransomware executable.
This YARA rule detects the PrincessLocker ransomware by identifying specific byte sequences associated with its file encryption routines and remote connection functionalities. The rule looks for three distinct patterns: one related to file encryption operations and two related to establishing remote connections. All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
This YARA rule detects the Ragnarok ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code sections responsible for finding files, encrypting files, disabling the firewall, and deleting shadow volumes, which are common behaviors of ransomware.
This Yara rule detects the Ransoc ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include scanning for services, establishing remote connections, finding files to encrypt, and performing file encryption. The rule looks for distinct sequences of assembly instructions that are characteristic of Ransoc's operational methods.
This YARA rule detects the RagnarLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes within executable files that are characteristic of RagnarLocker's operational code.
This YARA rule detects the Revil ransomware by identifying specific byte patterns associated with its file searching, encryption, remote connection, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within executable files that are characteristic of Revil's operations, including functions for searching files to encrypt, performing the encryption itself, establishing remote connections (likely for command and control or data exfiltration), and enumerating system resources.
This YARA rule detects the Rokku ransomware by identifying specific byte patterns associated with its file encryption, file finding, and folder finding functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the Rokku ransomware's code for these operations. The condition requires the presence of the standard Windows executable MZ header (0x5A4D) and all defined byte patterns for finding folders, finding files, and encrypting files.
This YARA rule detects the Ryuk ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p*, $find_files_p*, $remote_connection) that are characteristic of Ryuk's malicious operations. The rule requires all parts of the encryption and file finding patterns, as well as the remote connection pattern, to be present for a match.
Page 143 of 149