currently serving 21873 YARA rules and 3899 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
MAL_DLL_Jan25
Detects malicious DLL possibly related to Chaperone/TajMahal APT
10.01.2025
MAL_Legion_ShellCode_Jan25
Detects Legoin loader shellcoder
01.01.2025
MAL_Legion_DLL_Loader_Jan25
Detects Legoin loader DLL
01.01.2025
MAL_Legion_Loader_Jan25
Detects Legoin loader
01.01.2025
HKTL_ShadowHound_Dec24
Detects ShadowHound, a set of PowerShell scripts for Active Directory enumeration without the need for introducing known-malicious binaries like SharpHound
30.12.2024
MAL_PHP_Dec24_1
Detects a PHP script that infects PHP files to embed code for subsequent payload delivery, infects Baota (BT) panels to collect sensitive information and modify system files, downloads and executes next stage payload
27.12.2024
HKTL_SharpShares_Dec24
Detects SharpShares a hacktool that lists network share information from all machines in the current domain
25.12.2024
MAL_PS1_Veam_Password_Recovery_Dec24
Detects PowerShell script that recovers passwords used by Veeam to connect to remote hosts
24.12.2024
HKTL_CSHARP_SccmHound_Dec24
Detects sccmhound, a BloodHound collector for Microsoft Configuration Manager
23.12.2024
MAL_Badnews_Trojan_Dec24
Detects Badnews Trojan, which is used to execute commands through cmd, take screenshots, log keystrokes, collect a list of folders, and download additional payloads, seen being used by the Patchwork APT group
23.12.2024
MAL_PS1_Keylogger_Indicators_Dec24
Detects indicators of a PowerShell keylogger
21.12.2024
MAL_PS1_HWorm_Dec24
Detects HWorm PowerShell malware
21.12.2024
WEBSHELL_ASPX_Dec24_1
Detects ASPX web shells
21.12.2024
WEBSHELL_ASPX_Dec24_2
Detects ASPX web shells
21.12.2024
WEBSHELL_ASPX_Dec24_3
Detects unknown encoded ASPX web shells
21.12.2024
WEBSHELL_ASPX_Dec24_4
Detects ASPX web shells
21.12.2024
WEBSHELL_ASPX_Dec24_5
Detects ASPX web shells
21.12.2024
WEBSHELL_Encoded_Payloads_Dec24_6
Detects encoded payloads found in ASPX web shells
21.12.2024
WEBSHELL_ASPX_Dec24_7
Detects ASPX web shells
21.12.2024
WEBSHELL_OBFUSC_ASPX_Dec24_1
Detects obfuscated ASPX web shells
21.12.2024
WEBSHELL_ASPX_Dec24_8
Detects ASPX web shells
21.12.2024
WEBSHELL_MAL_ASPX_Dec24_9
Detects ASPX web shells
21.12.2024
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
4
e97c4ca275746e5ff92540eb35ef89b4503fcdec5d57518adfb71e4c59400084
SUSP_Suspicious_PowerShell_Indicator_Oct21_1
11
e64fb07d28793082acbbaad01d6dc2af94155eca467e000e1d430cdd2beba70d
HKTL_PS1_Hacktool_Indicator_Feb20_1
11
e64fb07d28793082acbbaad01d6dc2af94155eca467e000e1d430cdd2beba70d
SUSP_PS1_PowerShell_Script_Indicators_Jul21_2
11
e64fb07d28793082acbbaad01d6dc2af94155eca467e000e1d430cdd2beba70d
SUSP_PS1_Kernel32_Reference_Aug22
11
e64fb07d28793082acbbaad01d6dc2af94155eca467e000e1d430cdd2beba70d
SUSP_Wextract_Anomaly_Unsigned_May23
10
49e5408648e7c3bff5bec13fcb79b378e77978251eb9f9ec0456843dc47ac6a0
SUSP_W32tm_StripChart_Cmdline_Oct22_1
12
d12ebd234e722743d75f7c265459587cec2b02d3a8b087c032b20cdef67293a0
SUSP_RARSFX_Setup_Silent_Override
5
d923fbf2272ea3e2448ec8f8ca7b7aac3346852c63df7217de030ea9c1297093
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
6574
Threat Hunting (not subscribable, only in THOR scanner)
5214
APT
4919
Hacktools
4616
Webshells
2351
Exploits
650
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
CVE-2024-49113 Exploitation Attempt - LDAP Nightmare
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
08.01.2025
File Creation Related To RAT Clients
File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.
19.12.2024
Lummac Stealer Activity - Execution Of More.com And Vbc.exe
Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
19.12.2024
DNS Query Request By QuickAssist.EXE
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
19.12.2024
AWS SAML Provider Deletion Activity
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
19.12.2024
AWS Key Pair Import Activity
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
19.12.2024
New AWS Lambda Function URL Configuration Created
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
19.12.2024
QuickAssist Execution
Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.
19.12.2024
CVE-2024-50623 Exploitation Attempt - Cleo
Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.
09.12.2024
Modification or Deletion of an AWS RDS Cluster
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
06.12.2024
Suspicious ShellExec_RunDLL Call Via Ordinal
Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands.
Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.
01.12.2024
Setup16.EXE Execution With Custom .Lst File
Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
01.12.2024
Potential File Extension Spoofing Using Right-to-Left Override
Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
17.11.2024
Disable Application Bound Encryption for Chrome and Edge
Detects disabling of Application Bound Encryption for Google Chrome and Microsoft Edge by setting registry keys to 0.
14.11.2024
Expand File Over Admin Share
Detects the use of expand command to extract files from located on an administrative share, potentially used for lateral movement or staging files.
10.11.2024
Suspicious File Copy To Admin Share
Detects suspicious file copy operations to administrative shares, which may indicate lateral movement or malicious staging.
10.11.2024
Suspicious Use of RAR for File Archiving
Detects the use of `rar.exe` to create archives, which may indicate file compression for exfiltration or malicious purposes.
10.11.2024
Remote Execution Using PsExec
Detects suspicious use of PsExec to remotely execute a batch file located in unusual directories. This could indicate lateral movement or malicious activity, as seen in some cyberattack scenarios.
10.11.2024
Execution of ServiceUI.exe in Suspicious Location
Detects execution of ServiceUI.exe, a legitimate binary from the Microsoft Deployment Toolkit, potentially used for privilege escalation by running it outside of its expected directory.
06.11.2024
Execution via Serviceui.exe
Detects potential abuse of ServiceUI.exe for privilege escalation using specific flags that allow running applications in a system context within a user session.
06.11.2024
Potentially Suspicious Command Executed Via Run Dialog Box - Registry
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
01.11.2024
.RDP File Created by Outlook Process
Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments.
This can be used to detect spear-phishing campaigns that use RDP files as attachments.
01.11.2024
ValleyRAT Malware Registry Modification
Detects creation of registry keys used to store C2 seen used by the ValleyRAT malware
28.10.2024
Registry Modifications to Change Default Programs Handling Files
Detects change to the default program handling file extension, which could be used by threat actors to run there malware when a certain extension is opened.
28.10.2024
Hacktool Nifo Usage
Detects Nifo - a tool that disables Windows AV/EDR software by corrupting their files offline via physical access
27.10.2024
Registry Set for WinDefend Deletion
Detects the deletion of the WinDefend registry key in attempt to disable Windows Defender.
23.10.2024
Potential DLL Sideloading Via taskhost.exe
Detects potential DLL sideloading of "SbieDll.dll".
21.10.2024
Curl Variable Execution
Detecting curl execution with variable being passed as the domain to fetch data, could be used by threat actor to hide the actul malicious domain.
20.10.2024
YARA/SIGMA Rule Count
Rule Type
Community Feed
Nextron Private Feed
Yara
3209
18664
Sigma
3351
548
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
1251
windows / registry_set
201
windows / file_event
192
windows / ps_script
165
windows / security
157
linux / process_creation
118
windows / image_load
105
webserver
78
windows / system
72
macos / process_creation
65
windows / network_connection
52
proxy
52
linux / auditd
48
aws / cloudtrail
46
azure / activitylogs
43
windows / registry_event
38
azure / auditlogs
38
windows / ps_module
33
windows / application
29
azure / signinlogs
24
okta / okta
22
windows / process_access
22
windows / dns_query
22
azure / riskdetection
19
windows / pipe_created
18
opencanary / application
18
linux
17
rpc_firewall / application
17
windows / windefend
16
gcp / gcp.audit
16
bitbucket / audit
14
m365 / threat_management
13
windows / create_remote_thread
13
windows / file_delete
13
github / audit
13
cisco / aaa
12
windows / codeintegrity-operational
10
kubernetes / application / audit
10
windows / driver_load
10
windows / ps_classic_start
9
windows / create_stream_hash
9
windows / registry_add
9
linux / file_event
9
windows / firewall-as
8
dns
8
windows / msexchange-management
8
zeek / smb_files
7
antivirus
7
azure / pim
7
windows / appxdeployment-server
7
gcp / google_workspace.admin
7
windows / bits-client
7
windows / registry_delete
7
windows / dns-client
6
windows / file_access
6
linux / network_connection
5
jvm / application
5
kubernetes / audit
5
windows / sysmon
4
windows / taskscheduler
4
windows / iis-configuration
4
zeek / dce_rpc
4
zeek / dns
4
zeek / http
3
windows / wmi_event
3
windows / powershell-classic
3
windows / ntlm
3
linux / sshd
3
m365 / audit
2
linux / syslog
2
windows / dns-server
2
onelogin / onelogin.events
2
macos / file_event
2
apache
2
qualys
2
firewall
2
windows / security-mitigations
2
windows / file_change
2
spring / application
2
velocity / application
1
zeek / x509
1
windows / capi2
1
windows / microsoft-servicebus-client
1
windows / file_executable_detected
1
ruby_on_rails / application
1
m365 / exchange
1
linux / vsftpd
1
sql / application
1
linux / sudo
1
windows / diagnosis-scripted
1
windows / smbclient-security
1
windows / file_rename
1
m365 / threat_detection
1
zeek / rdp
1
windows / terminalservices-localsessionmanager
1
windows / sysmon_status
1
database
1
zeek / kerberos
1
windows / sysmon_error
1
windows / dns-server-analytic
1
windows / driver-framework
1
windows
1
windows / printservice-admin
1
nginx
1
windows / ps_classic_provider_start
1
windows / printservice-operational
1
netflow
1
cisco / bgp
1
windows / lsa-server
1
windows / wmi
1
fortios / sslvpnd
1
linux / auth
1
cisco / ldp
1
windows / ldap
1
django / application
1
cisco / syslog
1
linux / cron
1
windows / smbclient-connectivity
1
linux / clamav
1
juniper / bgp
1
windows / appmodel-runtime
1
windows / process_tampering
1
nodejs / application
1
paloalto / file_event / globalprotect
1
cisco / duo
1
linux / guacamole
1
huawei / bgp
1
windows / applocker
1
windows / openssh
1
python / application
1
paloalto / appliance / globalprotect
1
windows / appxpackaging-om
1
windows / raw_access_thread
1
windows / certificateservicesclient-lifecycle-system
1
windows / shell-core
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
237
windows / registry_set
63
windows / ps_script
56
windows / wmi
29
windows / file_event
23
windows / image_load
19
proxy
12
windows / security
11
linux / process_creation
11
windows / network_connection
7
windows / system
7
windows / kernel-event-tracing
6
windows / registry_event
6
windows / ntfs
5
windows / ps_module
5
windows / pipe_created
4
windows / sense
4
windows / create_remote_thread
4
windows / hyper-v-worker
3
windows / ps_classic_script
3
windows / vhd
3
webserver
3
windows / registry_delete
3
windows / application-experience
3
windows / kernel-shimengine
2
windows / taskscheduler
2
windows / driver_load
2
windows / bits-client
2
windows / file_delete
1
windows / firewall-as
1
windows / dns_query
1
windows / codeintegrity-operational
1
windows / file_rename
1
macos / process_creation
1
windows / amsi
1
windows / process_access
1
windows / application
1
windows / windefend
1
windows / audit-cve
1
windows / file_access
1
windows / registry-setinformation
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR