currently serving 16384 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_MAL_Indicators_Aug22_1
Detects suspicious opcode sequence only found in malicious or hacktool samples
18.08.2022
HKTL_Imphashes_Aug22_1
Detects different hacktools based on their imphash
17.08.2022
SUSP_HTML_Phishing_Payload_Indicators_Aug22_1
Detects suspicious ngrok.io reference in files
16.08.2022
SUSP_HTML_Base64_Phishing_Payload_Indicators_Aug22_1
Detects base64 encoded files (e.g. email attachments) with indicators found in phishing documents
16.08.2022
EXPL_DogWalk_Indicators_CVE_2022_34713_Aug22_1
Detects indicators found in payloads exploiting DogWalk vulnerability in Microsoft's Troubleshooters CVE-2022-34713
16.08.2022
HKTL_UPX_Taihou64_Aug22_2
Detects UPX compressed SharpHound components - LPE CVE-2015-1701
12.08.2022
SUSP_HKTL_SharpHound_Output_JSON_Aug22_1
Detects characteristics found in SharpHound output files
12.08.2022
SUSP_EXPL_UserAdd_Administrators_Aug22_1
Detects command line used to add a user and simultaneously add it to the local administrators group
12.08.2022
SUSP_Unknown_Dropper_Characteristics_Aug22_1
Detects characteristics found in very small droppers
12.08.2022
MAL_Unknown_Droppers_Aug22_1
Detects unknown droppers
12.08.2022
MAL_Woody_RAT_Embedded_DLL_Aug_22
Detects Embedded .Net DLL in Woody Rat which provides the C2 functionality
08.08.2022
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_Encoded_Net_ServicePointManager
12
7a12d2808fe622090cf015112b0994477fc059ec0b8c644518ddfe82f89cc013
MAL_Woody_RAT_Embedded_DLL_Aug_22
1
e7b21654763943317e707aab804e21ad02ee59ea6e1c816705b236f1b667d768
SUSP_PE_PasterBin_Raw_References_Nov21_1
4
8a9c932f4628c4f3f55de6effc3aa617f2535334b255a52e03c9532f27823a5d
SUSP_Base64_Encoded_Hex_Encoded_Code
2
29571b770b2789077d0653330f2937620d555fcb2cc4b7c5fac59d281fd92d44
SUSP_Base64_Encoded_Hex_Encoded_Code
2
a6feeec6b8636068fd055474d5fb695e9a9a97d5bdb56f611364c0351922ac48
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
5026
APT
4303
Hacktools
3830
Threat Hunting
3561
Webshells
2135
Exploits
485
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR