currently serving 24842 YARA rules and 4772 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
MAL_Shellcode_Loader_Nov26
Detects shellcode loader. This loader has been observed to be used in RRCfg implant campaigns but is not exclusive to it
04.11.2026
MAL_Reflective_Shellcode_Loader_Nov26
Detects reflective shellcode loaders. The loader has been observed in various malware campaigns like XLoader and Formbook. The loader will execute additional malware further investigation is advised.
03.11.2026
SUSP_OBUFSC_JS_Indicators_Nov26
Detects custom JavaScript obfuscation seen being used by DPRK threat actors
03.11.2026
SUSP_Payload_In_Certificate_Table_Mod_Nov26
Detects payload hidden in the signature area of a signed binary and loaded by a sideloaded DLL. A technique observed to be used by Chinese threat actors in business email compromise attacks.
02.11.2026
MAL_Donut_Loader_Nov26
Detects Donut loader, a shellcode loader staging payload used by various malware infection chains to load additional payloads.
02.11.2026
MAL_RRCfg_Implant_Nov26
Detects RRCfg implant, a modular C2 implant observed to be used for post-exploitation in business email compromise campaigns.
02.11.2026
APT_MAL_Arid_Viper_RAT_Oct26_1
Detects the Arid Viper RAT, which supports remote execution, screenshot collection, system reconnaissance, and persistence, seen being used by AridViper APT group
30.10.2026
APT_MAL_Arid_Viper_RAT_Oct26_2
Detects the Arid Viper RAT, which supports remote execution, screenshot collection, system reconnaissance, and persistence, seen being used by AridViper APT group
30.10.2026
MAL_AudioAuth_RAT_Oct26
Detects AudioAuth RAT used for remote command execution, screen capture, terminal interaction, and file operations through encrypted HTTPS C2 communicationm, seen being used by AridViper APT group
30.10.2026
MAL_JS_Claude_Code_SSH_Backdoor_Oct26
Detects malicious JavaScript file that establishes and persist a reverse ssh tunnel seen being used in Claude Code VSCode extension compromise
30.10.2026
SUSP_JS_SSH_Backdoor_Oct26
Detects suspicious indicators in JavaScript files used to enable SSH service and for reconnaissance
30.10.2026
SUSP_OBF_CFG_Flattening_Oct26
Detects suspicious control flow flattening opaque predicates, often indicative of obfuscated code
29.10.2026
LOG_Norma_UA_Oct26
Detects use of Norma, an engine that turns a language model into an autonomous agent. It runs a streaming tool-use loop that lets the model read, execute, and reason its way through a task, while the operator retains control over the prompt, the available tools, and the safety boundary. Norma is not malicious on its own.
28.10.2026
HKTL_ARTEX_Oct26
Detects ARTEX, an autonomous penetration-testing system driven by multi-agent LLMs
28.10.2026
HKTL_ARTEX_Docker_Oct26
Detects ARTEX docker compose file, an autonomous penetration-testing system driven by LLM multi-agents
28.10.2026
PUA_NORMA_Usage_Oct26
Detects use of Norma, an engine that turns a language model into an autonomous agent. It runs a streaming tool-use loop that lets the model read, execute, and reason its way through a task, while the operator retains control over the prompt, the available tools, and the safety boundary. Norma is not malicious on its own.
28.10.2026
SUSP_PHP_Loader_Indicators_Oct26
Detects suspicious PHP scripts that load and execute additional scripts or commands, often used in malware loaders
27.10.2026
SUSP_LNX_SUID_Exploitation_Indicators_Oct26
Detects common exploitation techniques for SUID binaries on Linux, often used in privilege escalation and post-exploitation
27.10.2026
SUSP_LNX_Hacktool_Name_Oct26
Detects occurrences of suspicious Linux hacktool names in scripts, often used in helper scripts for privilege escalation and post-exploitation
27.10.2026
SUSP_LNX_Loader_Indicators_Oct26
Detects suspicious Linux shell scripts that load and execute additional scripts or commands, often used in malware loaders
27.10.2026
PUA_VULN_Driver_MonProcessControl_Oct26
Detects vulnerable HONOR MonProcessControl driver, which can be abused by malware to kill privileged processes like EDR and antivirus solutions.
27.10.2026
PUA_VULN_Driver_Libwasys_Oct26
Detects vulnerable OpSwat Libwasys driver, which can be abused by malware to kill privileged processes like EDR and antivirus solutions.
27.10.2026
SUSP_LNX_Process_Name_Masquerading_Oct26
Detects process name masquerading, which is often used in malware to hide the true identity of a process
27.10.2026
MAL_LNX_PHP2SHELL_Exploit_Oct26
Detects PHP2SHELL-VULN-CVE-2026-109618 exploit capability in a Linux executable
26.10.2026
SUSP_VSIX_JS_Script_Dropper_Oct26
Detects dropper in malicious VS Code extensions that writes a JavaScript payload to disk and executes it
26.10.2026
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
8adbf3eae7bb633d6969672089c59f78278362cf8daa64d89857ed0f02948cee
SUSP_Base64_Encoded_Hex_Encoded_Code
8
8adbf3eae7bb633d6969672089c59f78278362cf8daa64d89857ed0f02948cee
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
40f816490ebecad62ac2ee2fec973d42a15b70c36291d619dfaa45674bf2359a
SUSP_Base64_Encoded_Hex_Encoded_Code
8
40f816490ebecad62ac2ee2fec973d42a15b70c36291d619dfaa45674bf2359a
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
6
5ebcf4c527fa1ec3709d04ceef4a22ad16294bdce3fe42f2ee385f5066c7d2d4
SUSP_Base64_Encoded_Hex_Encoded_Code
6
5ebcf4c527fa1ec3709d04ceef4a22ad16294bdce3fe42f2ee385f5066c7d2d4
SUSP_Base64_Encoded_Hex_Encoded_Code
9
23758ad4bf0a9341e8274d08007f11a139963918c6bc84a8ce27e8332123d9fe
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
9
23758ad4bf0a9341e8274d08007f11a139963918c6bc84a8ce27e8332123d9fe
SUSP_Base64_Encoded_Hex_Encoded_Code
7
b05a0a7daab562c2c1f98416a069b40b53b71f564383f3b47fa4f6317cc9c334
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
7
b05a0a7daab562c2c1f98416a069b40b53b71f564383f3b47fa4f6317cc9c334
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
eaad6d27f5e10cff6855c65f35c1ec84851a05fe66a8a20d9fc8e343d6c5bf7c
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
da63fa657054564abbf98745d4850867965a66cb53f2e75d09b569f0304cf285
SUSP_Base64_Encoded_Hex_Encoded_Code
8
eaad6d27f5e10cff6855c65f35c1ec84851a05fe66a8a20d9fc8e343d6c5bf7c
SUSP_Base64_Encoded_Hex_Encoded_Code
8
da63fa657054564abbf98745d4850867965a66cb53f2e75d09b569f0304cf285
SUSP_Go_Binary_Microsoft_Copyright
2
4452c999e645d3c437b28dae66a333b547327b57132a56bb1358eab0dbae094f
SUSP_Base64_Encoded_Hex_Encoded_Code
8
973c6aaee668a23d30f315974d88176ab254652bf994eccab63350f2fe7605d5
SUSP_Base64_Encoded_Hex_Encoded_Code
8
ca4ae4ef6216834c836020d6791de53070cda4d2d1897463053eb75baa9d6fa5
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
71092ddded52b4da67e24fb069af4087a066c7942883aeb41b7379909e620f31
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
973c6aaee668a23d30f315974d88176ab254652bf994eccab63350f2fe7605d5
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
8005
Threat Hunting (not subscribable, only in THOR scanner)
6157
APT
5109
Hacktools
4922
Webshells
2417
Exploits
758
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
DNS Query to Wildcard DNS Services - Network
Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain.
Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
05.11.2026
DNS Query to Wildcard DNS Services - Windows
Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain.
Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
05.11.2026
Microsoft Office Application Loading Task Scheduler DLL
Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks.
This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled
malicious documents attempting to establish persistence.
04.11.2026
ARTEX User Agent
Detects ARTEX user agent strings in proxy logs. ARTEX is an autonomous penetration-testing system driven by multi-agent LLMs
28.10.2026
Norma User Agent
Detects Norma user agent strings in proxy logs, an engine that turns a language model into an autonomous agent. It runs a streaming tool-use loop that lets the model read, execute, and reason its way through a task, while the operator retains control over the prompt, the available tools, and the safety boundary. Norma is not malicious on its own.
28.10.2026
BeyondTrust Secrets Utility Log File Deletion Attempt via CommandLine
Detects deletion attempt of bt-secrets.log files.
23.10.2026
BeyondTrust Secrets Utility Vault Credential Access via CommandLine
Detects execution of bt-secrets, a BeyondTrust (formerly Bomgar) proprietary CLI
utility used to query the appliance credential vault. Adversaries could abuse this
tool to harvest stored credentials during post-exploitation, as observed in
exploitation of CVE-2026-102764 (ARMORY CASTLE).
23.10.2026
AWS Bucket Block Public Access Weakened
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
21.10.2026
HackTool - GoldenDMSA Execution
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
19.10.2026
Potential Credential Discovery in Git History
Detects attempts to search git commit history for cloud provider credentials or API keys.
Attackers target git history because secrets that were committed and later removed remain recoverable,
making repositories a valuable source of credentials even after remediation.
Various supply chain attacks have been observed leveraging this technique to steal credentials from CI/CD environments.
19.10.2026
Potential Credential Discovery in Git History Windows
Detects attempts to search git commit history for credentials or API keys.
Attackers target git history because secrets that were committed and later removed remain recoverable,
making repositories a valuable source of credentials even after remediation.
Various supply chain attacks have been observed leveraging this technique to steal credentials from CI/CD environments.
19.10.2026
Cloud Provider Credential Exfiltration Attempt
Detects attempts to exfiltrate cloud provider credentials or API keys via network requests using tools like 'curl' or 'wget'.
Attackers commonly use these tools to send stolen secrets to attacker-controlled infrastructure after gaining initial access.
Various supply chain attacks have been observed leveraging this technique to exfiltrate credentials from CI/CD environments and cloud workloads.
18.10.2026
Cloud Provider Credential Dumping via Grep
Detects attempts to discover cloud provider credentials by directly invoking 'grep' with cloud provider-specific patterns.
Attackers commonly enumerate environment variables after gaining initial access to identify or steal credentials for further
exploitation, such as lateral movement or data exfiltration. Various supply chain attacks have been also seen leveraging this
technique to steal credentials.
18.10.2026
HackTool - Defendnot Installation via PowerShell One-Liner
Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
18.10.2026
Potential HackTool - Defendnot Security Center AV Registry Modification
Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
18.10.2026
Registry Tampering Of Internal Tools Settings
Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
18.10.2026
HackTool - Defendnot Default Scheduled Task Activity
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
18.10.2026
Shell Spawned by Celery Worker Process
Detects a system shell interpreter being spawned directly by a Celery worker process.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
17.10.2026
Process Masquerading as Kernel Worker Thread
Detects attempts to launch processes with names mimicking a Linux kernel worker thread.
Malware or the attacker uses this to evade detection masquerading as legitimate kernel
worker threads, while hiding its true identity.
16.10.2026
Suspicious Process Name Spoofing as Linux Kernel Thread
Detects a process impersonating a Linux kernel worker thread to evade
process-list inspection. Attackers rename malicious binaries or stage
legitimate LOLBins (e.g. curl, wget) under kernel thread names such as
[kworker/u8:2] to hide execution activity.
16.10.2026
Suspicious Procfs Comm Overwrite Attempt with Kernel Thread Name
Detects attempts to overwrite a process's displayed name in /proc/[pid]/comm
with a kernel worker thread name. Attackers use this technique after launching
a renamed binary or LOLBin (e.g. curl, wget) to retroactively change how the
process appears in monitoring tools, providing a second layer of camouflage
beyond argv[0] spoofing.
16.10.2026
Add Authorized Applications to Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the creation or re-enabling of per-application
exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
the targeted executable network access and can be abused by malware to bypass network restrictions.
13.10.2026
Allow Exceptions in Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
13.10.2026
System Binary Copied or Moved to Suspicious Directory
Detects the use of cp or mv to copy or move a system binary into a suspicious writable directory.
Attackers stage LOLBins like curl or wget in memory-backed or world-writable directories
to abuse their functionality while obscuring their origin.
12.10.2026
MSR Kernel Module Loaded with Write Access Enabled
Detects the loading of the 'msr' kernel module with 'allow_writes=on', which grants
userspace write access to CPU Model Specific Registers (MSRs). Attackers abuse this
to disable hardware security mitigations, tamper with CPU microcode behavior, or
as a primitive for Ring 0 exploitation. This behaviour is commonly observed in crypto-mining
malware or advanced persistent threats (APTs).
12.10.2026
Potential Timestomping via Touch Utility
Detects potential timestomping activity that uses a system binary or library
path as the reference file, which is a common timestomping technique on Linux.
Attackers copy timestamps from a trusted system binary onto a malicious file to make
it blend in with legitimate files and evade detection based on creation or modification time.
12.10.2026
Indicator of Obfuscated HTTP/HTTPS URL in PowerShell Script
Detects PowerShell script blocks containing an obfuscated HTTP or HTTPS URL.
Threat actors encode download URLs using a wide range of obfuscation techniques
to evade AMSI and string-based detections. Any single match is a reliable
indicator of deliberate obfuscation.
08.10.2026
Invocation of Obfuscated URL In CommandLine
Detects execution where the command line contains an obfuscated HTTP or HTTPS URL.
Threat actors encode download URLs using a wide range of obfuscation techniques - to evade AMSI and string-based detections.
Any single match is a reliable indicator of deliberate obfuscation.
08.10.2026
SELinux Disabling Attempt Indicators
Detects indicators of SELinux disabling via command line arguments. This includes attempts
to modify the SELinux configuration file as well as runtime changes to the SELinux enforcement
mode. This is a common post-exploitation technique to persistently disable SELinux across
reboots, reducing mandatory access control enforcement and evading security controls.
06.10.2026
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
06.10.2026
YARA/SIGMA Rule Count
Rule Type
Community Feed
Nextron Private Feed
Yara
1094
23748
Sigma
3638
1134
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
1368
windows / registry_set
222
windows / file_event
212
windows / ps_script
169
windows / security
165
linux / process_creation
143
windows / image_load
116
webserver
86
windows / system
74
macos / process_creation
69
aws / cloudtrail
58
proxy
55
linux / auditd
54
windows / network_connection
53
azure / auditlogs
44
windows / registry_event
40
azure / activitylogs
35
windows / ps_module
33
windows / application
32
windows / dns_query
29
windows / process_access
25
opencanary / application
24
okta / okta
22
azure / riskdetection
19
windows / pipe_created
19
azure / signinlogs
18
rpc_firewall / application
17
windows / windefend
17
linux
16
linux / file_event
16
gcp / gcp.audit
16
github / audit
15
bitbucket / audit
14
windows / file_delete
13
m365 / threat_management
13
cisco / aaa
13
windows / create_remote_thread
12
dns
11
windows / driver_load
10
windows / registry_delete
10
kubernetes / application / audit
10
windows / codeintegrity-operational
10
windows / create_stream_hash
9
windows / appxdeployment-server
9
antivirus
9
windows / ps_classic_start
9
windows / msexchange-management
8
windows / firewall-as
8
fortigate / event
7
windows / file_access
7
azure / pim
7
windows / bits-client
7
gcp / google_workspace.admin
7
zeek / smb_files
7
kubernetes / audit
6
windows / dns-client
6
jvm / application
5
zeek / dns
5
zeek / http
5
linux / network_connection
5
zeek / dce_rpc
4
m365 / audit
4
macos / file_event
4
windows / sysmon
4
windows / taskscheduler
4
windows / iis-configuration
4
windows / ntlm
3
windows / registry_add
3
linux / sshd
3
gcp / google_workspace.login
3
windows / wmi_event
3
windows / powershell-classic
3
windows / applocker
2
firewall
2
linux / syslog
2
windows / security-mitigations
2
apache
2
windows / dns-server
2
spring / application
2
windows / wmi
2
onelogin / onelogin.events
2
windows / printservice-operational
1
django / application
1
linux / auth
1
linux / guacamole
1
windows / appmodel-runtime
1
fortios / sslvpnd
1
linux / clamav
1
huawei / bgp
1
windows / openssh
1
cisco / syslog
1
linux / cron
1
juniper / bgp
1
windows / appxpackaging-om
1
windows / process_tampering
1
windows / smbclient-connectivity
1
windows / smbserver-connectivity
1
windows / shell-core
1
windows / file_change
1
paloalto / file_event / globalprotect
1
windows / certificateservicesclient-lifecycle-system
1
windows / microsoft-servicebus-client
1
windows / raw_access_thread
1
nodejs / application
1
paloalto / appliance / globalprotect
1
linux / vsftpd
1
zeek / x509
1
windows / capi2
1
python / application
1
windows / file_executable_detected
1
windows / diagnosis-scripted
1
windows / smbclient-security
1
windows / file_rename
1
windows / sysmon_error
1
ruby_on_rails / application
1
m365 / exchange
1
zeek / rdp
1
windows / terminalservices-localsessionmanager
1
windows / sysmon_status
1
windows
1
m365 / threat_detection
1
zeek / kerberos
1
windows / driver-framework
1
velocity / application
1
linux / sudo
1
sql / application
1
cisco / duo
1
cisco / ldp
1
nginx
1
windows / dns-server-analytic
1
windows / ldap
1
windows / ps_classic_provider_start
1
windows / printservice-admin
1
database
1
cisco / bgp
1
windows / lsa-server
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
553
windows / registry_set
99
windows / ps_script
96
linux / process_creation
82
windows / file_event
52
windows / image_load
49
windows / security
30
windows / wmi
29
proxy
15
windows / system
13
windows / network_connection
9
windows / registry_event
8
windows / kernel-event-tracing
6
windows / ntfs
5
windows / ps_module
5
windows / dns_query
5
windows / environment variable / THOR
4
windows / sense
4
windows / pipe_created
4
webserver
4
windows / taskscheduler
4
windows / registry_delete
4
windows / create_remote_thread
4
macos / process_creation
3
dns
3
windows / ps_classic_script
3
windows / vhd
3
windows / application-experience
3
windows / hyper-v-worker
3
windows / driver_load
3
linux / file_delete
2
linux / file_event
2
windows / file_access
2
windows / kernel-shimengine
2
linux / Linux kernel module / THOR
2
windows / smbclient-security
2
windows / process_access
2
windows / windefend
2
windows / bits-client
2
windows / codeintegrity-operational
2
windows / file_delete
2
windows / firewall-as
1
windows / amsi
1
windows / file_rename
1
linux / Unix user / THOR
1
windows / application
1
windows / audit-cve
1
windows / registry-setinformation
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR