Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This YARA rule detects the Linux-based LuckyJoe ransomware by identifying specific byte patterns within its main call functions and encryption routines. The rule looks for distinct sequences of assembly instructions related to the ransomware's core operations, including file encryption and internal message handling. The condition requires all parts of these identified patterns to be present, along with the ELF magic number, to ensure high fidelity detection of the LuckyJoe executable.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
Yara rule that detects KillDisk ransomware.
Yara rule that detects LuckyJoe ransomware.
Page 347 of 347