YARA rules for Lockbit

This rule detects the custom hashing algorithm of Lockbit4.0 unpacked

Detect the packer used by Lockbit4.0

Detect the implementation of RC4 Algorithm by Lockbit4.0

Detects LockBit ransomware samples for Linux and macOS

Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

Generic LockBit detection, also catches the version used in attacks in Indonesia.

Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709

Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection

Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966

Detects indicators found in LockBit ransomware

Detects indicators found in LockBit ransomware log files

autogenerated rule brought to you by yara-signator

Lockbit Payload

Detects forensic artifacts found in LockBit intrusions

Detects LockBit 5.0