New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_Shellcode_Keyword_Mar20_3
Detects files with shellcode indicators
27.03.2020
SUSP_ShellExec_RunDLL_PowerShell_Combo
Detects suspicious combination of ShellExec_RunDLL with powershell
27.03.2020
>
SUSP_Shellcode_Keyword_Mar20_2
Detects unknown malware with shellcode
27.03.2020
SUSP_Encoded_ReflectiveLoader
Detects encoded strings found in reflective loaders
27.03.2020
SUSP_Encoded_ShellCode
Detects encoded shellcode strings
27.03.2020
HKTL_FRPSocks_Config
Detects configuration files used by FRP proxy service often used by attackers
27.03.2020
>
MAL_Unknown_PS1_Octopus_Dropper_Mar20_1
Detects unknown PowerShell Octopus dropper
27.03.2020
MAL_PS1_Octopus_Mar20_1
Detects PowerShell Octupus malware
27.03.2020
MAL_ELF_Shellcode_Injector_Mar20_1
Detects unknown Linux malware with shellcode
27.03.2020
SUSP_BAT_Users_Public_Reference
Detects files with strange bat file references pointing to C:/Users/Public
25.03.2020
APT_APT41_CN_CampNetscaler_Mar20_1
Detects strings found in APT41 attacks against Netscaler and Zoho ManageEngine Desktop Central
25.03.2020
>
MAL_Powershell_PowerHub_Downloader_Mar20
Detects a PowerHub downloader / AMSI disabler
25.03.2020
SUSP_Base64EncodedActiveX_Mar20
Detects a Base64 encoded call to ActiveX
25.03.2020
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_RAR_with_PDF_Script_Obfuscation
4
11f74d091bbb9b5b95726a2504c3c74ab1f21eeb621bcc1b161469aca4bac896
>
SUSP_AutoIt_CompScript_NET_Combo
12
ad3853a768f78570c1b4572fbaa2b109fd86a5a7f4d426d61f192870a1ed6dca
>
SUSP_VBA_Project_Keyword_Feb19_1
1
87b8082bbbb1664d56e557a792b932b81a12343d267adf6431b887091e7328b6
>
SUSP_OfficeDoc_Macro_Indicator_Jun19_1
11
fc59f9c5cd53b2feb8e51849ee1e9ed3fda1c3f6cd1eac3a3a9444966a0deaac
>
SUSP_ELF_LNX_UPX_Compressed_File
13
0afff427f746bac33a85b5f0dbce50c6279fe0ba1db40a1031cfd4a70e2834ae
>
MAL_AutoIt_Malware_Indicator_1
11
d0474579f78f0aa0dcf76111c06b4c2315fa1926877ffa792f942ffbfa856bed
>
SUSP_AutoIt_CompScript_NET_Combo
11
d0474579f78f0aa0dcf76111c06b4c2315fa1926877ffa792f942ffbfa856bed
>
SUSP_AutoIt_Malware_Indicator_1
11
d0474579f78f0aa0dcf76111c06b4c2315fa1926877ffa792f942ffbfa856bed
>
SUSP_AutoIt_Indicators_Feb19_4
14
4abba380138ffc5cfaed2273f8170861a29b21b79ef6a650e190746923eac47e
>
Top Tags in YARA Rule Set
This list shows the top tags used in our database, which are used for the subscribable categories
Tag
Count
FILE
6823
EXE
4871
APT
2904
MAL
2874
HKTL
2595
DEMO
2450
T1100
1911
WEBSHELL
1880
SUSP
1414
CHINA
1048
SCRIPT
706
RUSSIA
413
T1086
409
MIDDLE_EAST
363
T1027
345
T1064
313
GEN
313
T1003
283
T1193
260
T1203
260
T1075
220
OBFUS
183
T1132
182
EXPLOIT
172
T1085
156
LINUX
154
T1178
140
T1097
140
METASPLOIT
114
T1050
113
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls