currently serving 24757 YARA rules and 4757 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
LOG_SUSP_EXPL_CVE_2026_111497_Oct26
Detects Node.js memory corruption that could be related to Node2Shell exploitation attempts (CVE-2026-111497)
23.10.2026
LOG_NodeJsCrash_Oct26
Detects artifacts related to Node.js memory corruption that could be related to Node2Shell exploitation
23.10.2026
MAL_RANSOM_Binary_Oct26
Detects indicators found in ransomware samples
22.10.2026
SUSP_Hidden_File_Download_Oct26_2
Detects hidden file being downloaded in suspicious location
22.10.2026
LOG_PHP2SHELL_Scanning_Artifacts_Oct26
Detects artifacts related to PHP2SHELL exploitation through public scanning tools
22.10.2026
LOG_PHP_Exploitation_Indicators_Oct26
Detects indicators of PHP exploitation, attackers exhaust server memory to prepare for further attacks.
22.10.2026
HKTL_PHP2SHELL_Exploit_Indicators_Oct26
Detects indicators of PHP2SHELL exploitation scripts
22.10.2026
LOG_SUSP_PHP2SHELL_Artifacts_Oct26
Detects potential artifacts related to PHP2SHELL exploitation, manual investigation is needed
21.10.2026
SUSP_Ransomware_Indicators_Oct26_1
Detects suspicious patterns indicating ransomwares or wipers
19.10.2026
MAL_LNX_Bot_Oct26
Detects Linux botnet with ELF infection, persistance and anti debug capabilities
16.10.2026
SUSP_WEBSHELL_Dropper_Oct26
Detects PHP dropper which writes a Webshell to temporary directory and loads it via PHP include
15.10.2026
SUSP_B64_WEBSHELL_Dropper_Oct26
Detects PHP droppers that decode a multi encoded blob of data containing suspicious PHP functions related to code execution.
15.10.2026
MAL_Downloader_Oct26_1
Detects a downloader written in C++ that deploys a WebSockets backdoor using XOR-encrypted strings and PEB-based API resolution, likely related to Iranian threat activity targeting Iraq
15.10.2026
MAL_Downloader_Oct26_2
Detects a downloader written in C# that deploys a WebSockets backdoor disguised as NVIDIA Container, likely related to Iranian threat activity targeting Iraq
15.10.2026
MAL_Websockets_Backdoor_Oct26
Detects WebSockets-based backdoor used for drive reconnaissance and data exfiltration, disguised as NVIDIA Container, likely related to Iranian threat activity targeting Iraq
15.10.2026
SUSP_PE_Manual_Loader_Oct26
Detects manual PE loader patterns, often used by malware to inject and execute code within other processes.
14.10.2026
SUSP_OBFUSC_YetAnotherObfuscator_Oct26
Detects binaries obfuscated by YetAnotherObfuscator. This obfuscator is often used to protect offensive security tools and malware. A match warrants further investigation.
14.10.2026
MAL_VAE_Sideloading_Payload_Oct26
Detects sideloading payload that serves as the initial stage for a malware delivery as a service operation.
14.10.2026
SUSP_Obfuscated_Go_Binary_Oct26
Detects obfuscated or stripped function names in Go binaries, often used by malware to evade detection. Could also be used for DRM purposes.
14.10.2026
SUSP_X64_PageTableWalk_Oct26
Detects specific x64 page table index calculation and PTE present-bit check logic in the physical-to-virtual translation routine. Often used by malware and cheats to bypass memory protections.
13.10.2026
SUSP_PHP_Webshell_Oct26
Detects potential PHP webshells that use specific $_POST parameters. Further investigation is advised.
13.10.2026
MAL_HEAVYGRAM_Backdoor_Oct26
Detects HEAVYGRAM backdoor written in Python, seen being used by Iran-nexus APT group
13.10.2026
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
HKTL_UAC_Bypass_CMSTPLUA_COM_May21
3
934fb766b3f4a852c66ad8c27e262059a006e3aff2534549d2f5df064395a114
PUA_ConnectWise_ScreenConnect_Mar23
13
7971f311426a4d664f0cabb29a4935eaefcbee626495338c732492dc47951c9f
SUSP_Base64_Encoded_GetEnvironmentVariable
14
3988f20c5f6b9d491fa58dc972da02afa74ea6e2655578e10d143a1c850073e1
SUSP_Base64_Encoded_GetEnvironmentVariable
3
130bf272a6b9687419267e11aa7896cf4f7201c52f31420f1009293392bf3b0b
SUSP_Base64_Encoded_GetEnvironmentVariable
3
dd57771c4bb43e7c8a5c62e837b9ec0f1933731f600c7d40a45fb7d8aea4dc25
SUSP_Base64_Encoded_GetEnvironmentVariable
14
f9e94e41192f772d88dbf4789eb9a17d45d830d91bcc03f7ba5307462807ab3d
PUA_ConnectWise_ScreenConnect_Mar23
9
d7c136c6784faafc8386e3fdede904da5b27a030629c60b9ca1ac6ca65536171
SUSP_Base64_Encoded_GetEnvironmentVariable
8
26ca8733c19a31eaade2de784d55871291e2e49f37c65110ecd355e3d7d460f3
HKTL_EXPL_Dell_LPE_CVE_2021_21551_Nov21
8
00e9c8369c05170c6f735afb2b44b5c719fda4acd9239d2dd560eb1af10c52c1
MAL_Driver_Basil_Windivertsys_Windivertdriver_8DA0
2
b33cdba51971369a7884389f7bdf130586c0b39c528512ecf6c5601859019bb8
MAL_Driver_Basil_Windivertsys_Windivertdriver_2F43
2
b33cdba51971369a7884389f7bdf130586c0b39c528512ecf6c5601859019bb8
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
7967
Threat Hunting (not subscribable, only in THOR scanner)
6117
APT
5106
Hacktools
4921
Webshells
2417
Exploits
757
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
AWS Bucket Block Public Access Weakened
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
21.10.2026
Potential Credential Discovery in Git History
Detects attempts to search git commit history for cloud provider credentials or API keys.
Attackers target git history because secrets that were committed and later removed remain recoverable,
making repositories a valuable source of credentials even after remediation.
Various supply chain attacks have been observed leveraging this technique to steal credentials from CI/CD environments.
19.10.2026
Potential Credential Discovery in Git History Windows
Detects attempts to search git commit history for credentials or API keys.
Attackers target git history because secrets that were committed and later removed remain recoverable,
making repositories a valuable source of credentials even after remediation.
Various supply chain attacks have been observed leveraging this technique to steal credentials from CI/CD environments.
19.10.2026
HackTool - GoldenDMSA Execution
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
19.10.2026
Cloud Provider Credential Exfiltration Attempt
Detects attempts to exfiltrate cloud provider credentials or API keys via network requests using tools like 'curl' or 'wget'.
Attackers commonly use these tools to send stolen secrets to attacker-controlled infrastructure after gaining initial access.
Various supply chain attacks have been observed leveraging this technique to exfiltrate credentials from CI/CD environments and cloud workloads.
18.10.2026
Cloud Provider Credential Dumping via Grep
Detects attempts to discover cloud provider credentials by directly invoking 'grep' with cloud provider-specific patterns.
Attackers commonly enumerate environment variables after gaining initial access to identify or steal credentials for further
exploitation, such as lateral movement or data exfiltration. Various supply chain attacks have been also seen leveraging this
technique to steal credentials.
18.10.2026
HackTool - Defendnot Installation via PowerShell One-Liner
Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
18.10.2026
Potential HackTool - Defendnot Security Center AV Registry Modification
Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
18.10.2026
Registry Tampering Of Internal Tools Settings
Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
18.10.2026
HackTool - Defendnot Default Scheduled Task Activity
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
18.10.2026
Shell Spawned by Celery Worker Process
Detects a system shell interpreter being spawned directly by a Celery worker process.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
17.10.2026
Add Authorized Applications to Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the creation or re-enabling of per-application
exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
the targeted executable network access and can be abused by malware to bypass network restrictions.
13.10.2026
Allow Exceptions in Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
13.10.2026
Indicator of Obfuscated HTTP/HTTPS URL in PowerShell Script
Detects PowerShell script blocks containing an obfuscated HTTP or HTTPS URL.
Threat actors encode download URLs using a wide range of obfuscation techniques
to evade AMSI and string-based detections. Any single match is a reliable
indicator of deliberate obfuscation.
08.10.2026
Invocation of Obfuscated URL In CommandLine
Detects execution where the command line contains an obfuscated HTTP or HTTPS URL.
Threat actors encode download URLs using a wide range of obfuscation techniques - to evade AMSI and string-based detections.
Any single match is a reliable indicator of deliberate obfuscation.
08.10.2026
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
06.10.2026
SELinux Disabling Attempt Indicators
Detects indicators of SELinux disabling via command line arguments. This includes attempts
to modify the SELinux configuration file as well as runtime changes to the SELinux enforcement
mode. This is a common post-exploitation technique to persistently disable SELinux across
reboots, reducing mandatory access control enforcement and evading security controls.
06.10.2026
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script
Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands
and invoke cmdlets indirectly by array index. This can be used to evade detections
that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
06.10.2026
Shell or Interpreter Executed From Non-Standard Path on Linux
Detects a shell binary executed from a path outside standard system locations.
After gaining initial code execution on a Linux host, threat actors commonly copy
or rename shell binaries (bash, sh, dash) into world-writable directories to masquerade
as legitimate processes to evade detections. In privilege escalation scenarios, the
copied shell is additionally granted the SUID bit via chmod so that subsequent invocations
run as root regardless of the calling user's privileges.
05.10.2026
SUID Bit Set on Shell via Chmod for Privilege Escalation
Detects chmod being used to set the SUID bit on a file, a common post-exploitation
technique for privilege escalation on Linux. After gaining low-privileged code
execution (e.g. as nobody or www-data), attackers copy a shell binary or custom
backdoor to a writable path, set the SUID bit so it executes as root, then invoke
it to obtain a root shell.
05.10.2026
Linux Security Control Disabling Attempt
Detects attempts to forcefully kill Linux mandatory access control frameworks.
Attackers commonly terminate these security services as a post-exploitation step
to reduce visibility and weaken host defences before lateral movement or data exfiltration.
02.10.2026
Suspicious Crontab Pipeline Injection
Detects suspicious crontab pipeline injection patterns where an attacker reads the
existing crontab with crontab -l, appends a malicious entry via echo, and writes it
back using crontab - (stdin mode), as legitimate crontab edits are done
interactively via crontab -e rather than from stdin.
30.09.2026
Bulk Process Termination via PowerShell Whitelist Exclusion
Detects PowerShell commands that enumerate all running processes and terminate those
not matching a hardcoded whitelist. This pattern is characteristic of ransomware and
destructive malware that kills security tools, backup agents, and database services
before payload execution.
30.09.2026
ETW Bypass via EtwEventWrite Memory Patch
Detects ETW bypass attempts via memory patching of the EtwEventWrite function in ntdll.dll.
Threat actors may use this technique to evade detection by security tools that rely on ETW for monitoring.
30.09.2026
Process Termination via PowerShell Enumeration Pipeline
Detects PowerShell commands that enumerate all running processes and terminate them
via a pipeline or loop. It is commonly observed in post-exploitation tooling and ransomware
precursor activity where specific process categories such as security tools, backup agents,
or database services are killed before payload execution.
30.09.2026
Uncommon Child Process Spawned From XBootMgrSleep.EXE
Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe.
XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
27.09.2026
HackTool - Defendnot Execution
Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
27.09.2026
Potentially Suspicious Image Load of Tlscsp.dll
Detects tlscsp.dll ("Microsoft Remote Desktop Services Cryptographic Utility")
loaded by a process outside standard Microsoft or system directories. The DLL
contains a hardcoded RC4 key exposed through its LsCsp_EncryptHwid export,
providing a predictable cryptographic primitive that malware can leverage to
decrypt payloads or encrypt data without embedding custom crypto code. Loading
this DLL from an unexpected location is potentially suspicious, as threat actors
abuse a trusted system component to perform cryptographic operations natively,
bypassing detection that would otherwise flag unsigned or anomalous crypto implementations.
24.09.2026
System-Wide Windir or SystemRoot Environment Variable Tampering via Registry
Detects modifications to the system-wide windir or SystemRoot environment variables.
Attackers may redirect these variables to a malicious directory to hijack execution of processes that rely on them, enabling privilege escalation or persistence.
23.09.2026
TEMP or TMP Environment Variable Tampering via Registry
Detects modifications to the TEMP or TMP environment variables via registry.
Attackers may redirect these variables to a malicious directory to control where temporary files are written, potentially enabling privilege escalation or persistence.
23.09.2026
YARA/SIGMA Rule Count
Rule Type
Community Feed
Nextron Private Feed
Yara
1094
23663
Sigma
3635
1122
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
1368
windows / registry_set
222
windows / file_event
212
windows / ps_script
169
windows / security
165
linux / process_creation
143
windows / image_load
115
webserver
86
windows / system
74
macos / process_creation
69
aws / cloudtrail
58
proxy
55
linux / auditd
54
windows / network_connection
53
azure / auditlogs
44
windows / registry_event
40
azure / activitylogs
35
windows / ps_module
33
windows / application
32
windows / dns_query
28
windows / process_access
25
opencanary / application
24
okta / okta
22
azure / riskdetection
19
windows / pipe_created
19
azure / signinlogs
18
rpc_firewall / application
17
windows / windefend
17
linux
16
linux / file_event
16
gcp / gcp.audit
16
github / audit
15
bitbucket / audit
14
windows / file_delete
13
m365 / threat_management
13
cisco / aaa
13
windows / create_remote_thread
12
windows / driver_load
10
windows / registry_delete
10
kubernetes / application / audit
10
windows / codeintegrity-operational
10
dns
10
windows / create_stream_hash
9
windows / appxdeployment-server
9
antivirus
9
windows / ps_classic_start
9
windows / msexchange-management
8
windows / firewall-as
8
fortigate / event
7
windows / file_access
7
azure / pim
7
windows / bits-client
7
gcp / google_workspace.admin
7
zeek / smb_files
7
kubernetes / audit
6
windows / dns-client
6
jvm / application
5
zeek / dns
5
linux / network_connection
5
zeek / http
5
zeek / dce_rpc
4
m365 / audit
4
macos / file_event
4
windows / sysmon
4
windows / taskscheduler
4
windows / iis-configuration
4
windows / ntlm
3
windows / registry_add
3
linux / sshd
3
gcp / google_workspace.login
3
windows / wmi_event
3
windows / powershell-classic
3
windows / applocker
2
firewall
2
linux / syslog
2
windows / security-mitigations
2
windows / dns-server
2
spring / application
2
apache
2
windows / wmi
2
onelogin / onelogin.events
2
django / application
1
windows / printservice-operational
1
linux / clamav
1
linux / auth
1
linux / guacamole
1
fortios / sslvpnd
1
linux / cron
1
juniper / bgp
1
windows / appmodel-runtime
1
windows / openssh
1
cisco / syslog
1
huawei / bgp
1
windows / appxpackaging-om
1
windows / smbclient-connectivity
1
windows / smbserver-connectivity
1
windows / file_change
1
windows / process_tampering
1
paloalto / file_event / globalprotect
1
windows / certificateservicesclient-lifecycle-system
1
windows / shell-core
1
windows / raw_access_thread
1
nodejs / application
1
paloalto / appliance / globalprotect
1
zeek / x509
1
windows / capi2
1
windows / microsoft-servicebus-client
1
windows / file_executable_detected
1
python / application
1
linux / vsftpd
1
windows / diagnosis-scripted
1
windows / smbclient-security
1
windows / file_rename
1
windows / sysmon_status
1
ruby_on_rails / application
1
m365 / exchange
1
zeek / rdp
1
windows / sysmon_error
1
m365 / threat_detection
1
zeek / kerberos
1
windows / terminalservices-localsessionmanager
1
velocity / application
1
windows / driver-framework
1
windows
1
linux / sudo
1
sql / application
1
cisco / duo
1
cisco / ldp
1
nginx
1
windows / dns-server-analytic
1
database
1
windows / ldap
1
windows / ps_classic_provider_start
1
windows / printservice-admin
1
cisco / bgp
1
windows / lsa-server
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
552
windows / registry_set
99
windows / ps_script
96
linux / process_creation
74
windows / file_event
52
windows / image_load
49
windows / security
29
windows / wmi
29
proxy
13
windows / system
13
windows / network_connection
9
windows / registry_event
8
windows / kernel-event-tracing
6
windows / ntfs
5
windows / ps_module
5
windows / dns_query
5
windows / sense
4
windows / environment variable / THOR
4
windows / pipe_created
4
windows / taskscheduler
4
webserver
4
windows / create_remote_thread
4
windows / registry_delete
4
macos / process_creation
3
dns
3
windows / ps_classic_script
3
windows / vhd
3
windows / application-experience
3
windows / hyper-v-worker
3
windows / driver_load
3
linux / file_delete
2
windows / kernel-shimengine
2
windows / file_access
2
windows / smbclient-security
2
linux / Linux kernel module / THOR
2
windows / windefend
2
windows / process_access
2
windows / codeintegrity-operational
2
windows / bits-client
2
windows / file_delete
2
linux / file_event
2
windows / file_rename
1
windows / audit-cve
1
linux / Unix user / THOR
1
windows / amsi
1
windows / firewall-as
1
windows / registry-setinformation
1
windows / application
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR