Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,261 detections
Filters
Last updated
All Time
Detection languages
3,336
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,025
2,537
1,073
1,047
927
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,269
1,334
1,318
898
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Yara rule that detects AcidRain trojan.
This rule detects the Linux_Backdoor_Krasue malware. It identifies specific byte patterns within the executable that correspond to functions for switching servers, getting hostname information, starting server processes, sending encrypted data, and notifying the server. The rule also checks for the ELF magic number to ensure it's a Linux executable.
Yara rule that detects Krasue backdoor.
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
This rule detects the Linux Vit virus by identifying a specific byte sequence at the entry point of an ELF executable and the presence of the string "vi324.tmp" within the file. The rule specifically targets ELF files, indicating its focus on Linux executables.
Linux Virus Vit
YARA
Yara rule that detects Vit virus.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the RedAlert ransomware by identifying specific byte patterns within the executable. The patterns correspond to functions involved in setting up the environment, finding files to encrypt, encrypting files, and making configuration changes, which are characteristic behaviors of the RedAlert ransomware.
Yara rule that detects RedAlert ransomware.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
This YARA rule detects the Linux-based LuckyJoe ransomware by identifying specific byte patterns within its main call functions and encryption routines. The rule looks for distinct sequences of assembly instructions related to the ransomware's core operations, including file encryption and internal message handling. The condition requires all parts of these identified patterns to be present, along with the ELF magic number, to ensure high fidelity detection of the LuckyJoe executable.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
Yara rule that detects KillDisk ransomware.
Yara rule that detects LuckyJoe ransomware.
Page 346 of 346