YARA rules for DarkSide
8 rules from 5 sources detect DarkSide. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware, Suspicious / hunting.
Family grouping is heuristic: check each rule's description.
Scan files with all DarkSide rulesSearch rules
Detects Darkside Ransomware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-10Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values.
MalwareSignature Base (Florian Roth / Nextron)· FireEye· 2021-03-22autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04Detects files referencing identities associated with DarkSide ransomware
Suspicious / huntingditekSHen detection· ditekShen· 2021-01-21Rule to detect Darkside Ransomware as a DLL
MalwareTrellix Advanced Research Center· TS @ McAfee ATR· 2021-05-14Rule to detect packed and unpacked samples of DarkSide
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-08-11Detection for on the binary that was used as the dropper leading to DARKSIDE.
MalwareSignature Base (Florian Roth / Nextron)· FireEye· 2021-05-11- ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1Metadata only
Detect the ELF version of Darkside ransomware
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-01