currently serving 24711 YARA rules and 4740 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
MAL_Downloader_Oct26_1
Detects a downloader written in C++ that deploys a WebSockets backdoor using XOR-encrypted strings and PEB-based API resolution, likely related to Iranian threat activity targeting Iraq
15.10.2026
MAL_Downloader_Oct26_2
Detects a downloader written in C# that deploys a WebSockets backdoor disguised as NVIDIA Container, likely related to Iranian threat activity targeting Iraq
15.10.2026
MAL_Websockets_Backdoor_Oct26
Detects WebSockets-based backdoor used for drive reconnaissance and data exfiltration, disguised as NVIDIA Container, likely related to Iranian threat activity targeting Iraq
15.10.2026
MAL_VAE_Sideloading_Payload_Oct26
Detects sideloading payload that serves as the initial stage for a malware delivery as a service operation.
14.10.2026
SUSP_PE_Manual_Loader_Oct26
Detects manual PE loader patterns, often used by malware to inject and execute code within other processes.
14.10.2026
MAL_LNX_Chankro_LPE_Oct26
Detects Chankro Linux local privilege escalation library. Used for privilege escalation attacks and PHP backdoors.
13.10.2026
MAL_HEAVYGRAM_Backdoor_Oct26
Detects HEAVYGRAM backdoor written in Python, seen being used by Iran-nexus APT group
13.10.2026
HKTL_SessionExec_Oct26
Detects SessionExec, a hacktool to execute commands in other Windows sessions
12.10.2026
HKTL_Group3r_Oct26
Detects Group3r, a hacktool to find vulnerabilities in AD Group Policy
12.10.2026
HKTL_Invoke_AdEnum_Oct26
Detects the script or output of Invoke-ADEnum, a PowerShell hacktool for Active Directory auditing and enumeration
12.10.2026
SUSP_PS1_Hacktool_Authors_Oct26
Detects PowerShell scripts containing references to known hacktool authors
12.10.2026
SUSP_LNX_Downloader_Script_Oct26
Detects suspicious Linux downloader scripts that fetch multiple CPU-architecture-specific payloads via wget/curl, a pattern commonly used by IoT/Linux botnet droppers
07.10.2026
MAL_RootKitHideProcess_Oct26
Detects RootKitHideProcess rootkit that is used to hide processes and the kernel driver from standard system enumeration.
07.10.2026
SUSP_LNX_Pkill_Security_Control_Oct26
Detects Linux scripts or binaries attempting to kill security control processes
06.10.2026
MAL_PaperCut_Java_Loader_Oct26
Detects a malicious Java loader associated with PaperCut MF intrusions that dynamically loads and executes an embedded payload within the PaperCut application environment.
06.10.2026
MAL_PaperCut_Java_WebShell_Oct26
Detects a malicious Java web shell associated with PaperCut MF intrusions that enables remote command execution and dynamic code execution within the compromised PaperCut application environment.
06.10.2026
MAL_PaperCut_Obfuscated_AdaptixC2_Oct26
Detectes an obfuscated AdaptixC2 implant associated with PaperCut zero-day attack
06.10.2026
SUSP_KeyLogger_Oct26
Detects suspicious keylogger activity.
06.10.2026
SUSP_LNX_Bash_Dropper_Oct26
Detects suspicious Linux bash droppers.
06.10.2026
MAL_LNX_Dropper_Oct26
Detects a dropper which decrypts and executes an embedded installer shell script
05.10.2026
MAL_LNX_AveRAT_Oct26
Detects AveRAT variants using SMTP and STARTTLS for covert C2 communication, disguising the traffic as legitimate email activity, seen being used in attacks targeting Taiwanese network-edge appliances.
05.10.2026
MAL_Rekoobe_Backdoor_Oct26
Detects Rekoobe backdoor variants that use SMTP traffic to receive specially crafted magic packets for covert activation and C2 communication, seen being used in attacks targeting South Korea
05.10.2026
SUSP_OBFUSC_Wordpress_Plugin_Oct26
Detects obfuscated Wordpress plugin
05.10.2026
HKTL_Go_Responder_Oct26
Detects go-responder, a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2
05.10.2026
MAL_OBFUSC_Webshell_Oct26
Detects obfuscated webshell
05.10.2026
SUSP_PHP_Hex_Obfuscation_Oct26
Detects suspicious PHP scripts using \\x for obfuscation of single characters in strings
05.10.2026
WEBSHELL_Wordpress_Fake_Plugin_Oct26
Detects a webshell posing as a Wordpress plugin
05.10.2026
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
PUA_ConnectWise_ScreenConnect_Mar23
11
784128b3e4b07d01dab8ddad851433161d7b28cd0a609f4c03ea4874c283e4ef
SUSP_Base64_Encoded_Hex_Encoded_Code
8
2296af507872d005bdb67c7a43f5de2f9edf4a97cb17d6cc04065eadd07912ee
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
8
2296af507872d005bdb67c7a43f5de2f9edf4a97cb17d6cc04065eadd07912ee
SUSP_OBFUSC_Telegram_Bot_Indicators_Sep25
9
1df9e65e89b6fc3e8f4bfabf1c831db1b1dd422c1197f697b5a0676ff506fabd
SUSP_Encoded_GetProcAddress_Mar19
9
1df9e65e89b6fc3e8f4bfabf1c831db1b1dd422c1197f697b5a0676ff506fabd
SUSP_PY_OBFUSC_Dropper_Indicators_Sep25_Small
9
1df9e65e89b6fc3e8f4bfabf1c831db1b1dd422c1197f697b5a0676ff506fabd
SUSP_BAT_Loader_Indicators_FromBase64_Sep25
9
1df9e65e89b6fc3e8f4bfabf1c831db1b1dd422c1197f697b5a0676ff506fabd
HKTL_SUSP_Amsi_DLL_Keywords_Mar21_2
9
1df9e65e89b6fc3e8f4bfabf1c831db1b1dd422c1197f697b5a0676ff506fabd
HKTL_SUSP_Amsi_DLL_Keywords_Mar21_1
9
1df9e65e89b6fc3e8f4bfabf1c831db1b1dd422c1197f697b5a0676ff506fabd
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
7943
Threat Hunting (not subscribable, only in THOR scanner)
6103
APT
5106
Hacktools
4920
Webshells
2412
Exploits
753
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
Allow Exceptions in Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
13.10.2026
Add Authorized Applications to Microsoft Defender Firewall via Registry
Detects the degradation of the system firewall security by the creation or re-enabling of per-application
exceptions via registry writes to the AuthorizedApplications\List keys under FirewallPolicy, which grants
the targeted executable network access and can be abused by malware to bypass network restrictions.
13.10.2026
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
06.10.2026
SELinux Disabling Attempt Indicators
Detects indicators of SELinux disabling via command line arguments. This includes attempts
to modify the SELinux configuration file as well as runtime changes to the SELinux enforcement
mode. This is a common post-exploitation technique to persistently disable SELinux across
reboots, reducing mandatory access control enforcement and evading security controls.
06.10.2026
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script
Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands
and invoke cmdlets indirectly by array index. This can be used to evade detections
that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
06.10.2026
Shell or Interpreter Executed From Non-Standard Path on Linux
Detects a shell binary executed from a path outside standard system locations.
After gaining initial code execution on a Linux host, threat actors commonly copy
or rename shell binaries (bash, sh, dash) into world-writable directories to masquerade
as legitimate processes to evade detections. In privilege escalation scenarios, the
copied shell is additionally granted the SUID bit via chmod so that subsequent invocations
run as root regardless of the calling user's privileges.
05.10.2026
SUID Bit Set on Shell via Chmod for Privilege Escalation
Detects chmod being used to set the SUID bit on a file, a common post-exploitation
technique for privilege escalation on Linux. After gaining low-privileged code
execution (e.g. as nobody or www-data), attackers copy a shell binary or custom
backdoor to a writable path, set the SUID bit so it executes as root, then invoke
it to obtain a root shell.
05.10.2026
Linux Security Control Disabling Attempt
Detects attempts to forcefully kill Linux mandatory access control frameworks.
Attackers commonly terminate these security services as a post-exploitation step
to reduce visibility and weaken host defences before lateral movement or data exfiltration.
02.10.2026
Suspicious Crontab Pipeline Injection
Detects suspicious crontab pipeline injection patterns where an attacker reads the
existing crontab with crontab -l, appends a malicious entry via echo, and writes it
back using crontab - (stdin mode), as legitimate crontab edits are done
interactively via crontab -e rather than from stdin.
30.09.2026
ETW Bypass via EtwEventWrite Memory Patch
Detects ETW bypass attempts via memory patching of the EtwEventWrite function in ntdll.dll.
Threat actors may use this technique to evade detection by security tools that rely on ETW for monitoring.
30.09.2026
Process Termination via PowerShell Enumeration Pipeline
Detects PowerShell commands that enumerate all running processes and terminate them
via a pipeline or loop. It is commonly observed in post-exploitation tooling and ransomware
precursor activity where specific process categories such as security tools, backup agents,
or database services are killed before payload execution.
30.09.2026
Bulk Process Termination via PowerShell Whitelist Exclusion
Detects PowerShell commands that enumerate all running processes and terminate those
not matching a hardcoded whitelist. This pattern is characteristic of ransomware and
destructive malware that kills security tools, backup agents, and database services
before payload execution.
30.09.2026
Uncommon Child Process Spawned From XBootMgrSleep.EXE
Detects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe.
XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary executable after a delay.
27.09.2026
Potentially Suspicious Image Load of Tlscsp.dll
Detects tlscsp.dll ("Microsoft Remote Desktop Services Cryptographic Utility")
loaded by a process outside standard Microsoft or system directories. The DLL
contains a hardcoded RC4 key exposed through its LsCsp_EncryptHwid export,
providing a predictable cryptographic primitive that malware can leverage to
decrypt payloads or encrypt data without embedding custom crypto code. Loading
this DLL from an unexpected location is potentially suspicious, as threat actors
abuse a trusted system component to perform cryptographic operations natively,
bypassing detection that would otherwise flag unsigned or anomalous crypto implementations.
24.09.2026
Potential PowerShell Keylogger via Low-Level Keyboard Hook
Detects PowerShell ScriptBlock containing inline C# that installs a low-level keyboard hook
via SetWindowsHookEx with the WH_KEYBOARD_LL hook type. Attackers use Add-Type to compile
and execute a keylogger entirely in memory, intercepting all keystrokes system-wide without
dropping a standalone binary to disk. The presence of CallNextHookEx confirms a chained hook
implementation, distinguishing it from benign API references.
16.09.2026
Potential PowerShell Screen Capture via Win32 GDI BitBlt
Detects PowerShell ScriptBlock using the Win32 GDI BitBlt API to capture screen content.
Attackers use this native approach to silently copy display pixel data without dropping a
standalone capture binary, a technique commonly observed in keyloggers, RATs and spyware.
16.09.2026
Suspicious PowerShell System Reconnaissance Via DotNET Environment Class
Detects PowerShell commands that access .NET [Environment] class properties for
system reconnaissance when spawned from a suspicious location. Attackers use these
properties to enumerate user and session context, system hardware info, OS version,
filesystem paths and/or environment variables during post-exploitation profiling prior
to payload staging or lateral movement. Rather than relying on external tools or registry
queries, attackers may gather system information directly from the .NET Environment class
while executing from user-writable directories such as Temp, Downloads, or Public folders.
14.09.2026
Suspicious System Info Discovery via CurrentVersion Registry Key
Detects attempts to query values under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
for system reconnaissance when initiated from a suspicious location. This key exposes a
broad set of host profiling data including OS edition, build details, installation type
and patch level. Attackers read these values during post-exploitation to profile the target
before selecting a payload or escalation path, often executing from user-writable directories
such as Temp, Downloads, or Public folders.
14.09.2026
PowerShell Script Execution From Environment Variable - ScriptBlock
Detects PowerShell loading and executing a script stored inside an environment variable.
Attackers use this to hide the malicious code from command-line logs and security tools,
since the actual script is never written to disk or shown in the process arguments.
08.09.2026
PowerShell Script Execution From Environment Variable - CommandLine
Detects PowerShell loading and executing a script stored inside an environment variable.
Attackers use this to hide the malicious code from command-line logs and security tools,
since the actual script is never written to disk or shown in the process arguments.
08.09.2026
Recon Command Output Redirected to Temporary File
Detects the execution of common Windows reconnaissance commands (ipconfig, net, netstat,
ping, systeminfo, tasklist, whoami) with their output redirected to a file via the ">"
operator. Attackers and post-exploitation frameworks commonly use this pattern to silently
collect host enumeration data and stage it for later retrieval, rather than displaying
output interactively or piping it to another tool.
04.09.2026
Process Enumeration via WMI
Detects PowerShell commands that use WMI to enumerate processes via the Win32_Process class.
Threat actors may use this technique during post-exploitation to inspect running process arguments, which may reveal credentials,
configuration details, or identify defensive tools for further targeting.
03.09.2026
Kernel Driver Service ImagePath Set by Potentially Suspicious Process
Detects kernel driver service ImagePath registry values being set by potentially suspicious processes.
This can indicate attempts to load kernel drivers without using the standard Service Control Manager,
which malware may use to maintain persistence or employ BYOVD techniques often used in EDR killer tools.
It's recommended to first baseline this rule in your environment and adjust it accordingly before enabling
it in production.
02.09.2026
Kernel Driver Service ImagePath Pointing to Non-Standard Location
Detects kernel driver service ImagePath registry values that point to non-standard locations outside typical Windows driver directories.
This may indicate attempts to load malicious or vulnerable kernel drivers for persistence or privilege escalation, a technique commonly
observed in EDR-killer tools that drop a driver to a non-standard location before loading it for further exploitation. It's recommended
to first baseline this rule in your environment and adjust it accordingly before enabling it in production.
02.09.2026
PUA - Tailcat Saved Key Generation - Linux
Detects the generation of Tailcat saved keys that persist the secret between multiple sessions. Using Tailcat persistently is unusual in corporate environments.
02.09.2026
PUA - Tailcat Saved Key Generation - Windows
Detects the generation of Tailcat saved keys that persist the secret between multiple sessions. Using Tailcat persistently is unusual in corporate environments.
02.09.2026
Remote PDF Opened via Explorer with HTTP URL
Detects explorer.exe being invoked with an HTTP URL pointing to a remote PDF file.
Attackers use this technique to display a decoy document while a malicious payload
executes in the background, distracting the victim after LNK-based initial access.
explorer.exe is not normally launched from the command line with a remote HTTP path;
its appearance in such a context is a strong indicator of a scripted attack chain.
31.08.2026
EventLog Metadata Inspection Via Wevtutil
Detects the eventlog metadata inspection attempt via wevtutil.exe.
Threat actors use these to verify whether security logging is active and gauge
how much time they have before entries are overwritten, before performing intrusive actions.
27.08.2026
Email Protocol Access Via Curl
Detects curl.exe being used to access email servers over IMAP or SMTP protocols.
Curl natively supports IMAP/IMAPS and SMTP/SMTPS, allowing attackers to interact with
mailboxes directly from the command line - reading inbox contents, selecting folders,
or sending messages - without deploying a dedicated mail client. This technique is used
for C2 communication via corporate mail infrastructure and for data exfiltration, blending
with legitimate email traffic.
27.08.2026
Renamed Node.js Binary Execution
Detects the execution of a renamed Node.js JavaScript runtime, normally named "node.exe".
Node.exe is the executable file for the Node.js JavaScript runtime and is typically used
to execute JavaScript code outside a web browser environment. Threat actors may
rename the Node.js executable to a random name to run malicious scripts stealthily.
26.08.2026
YARA/SIGMA Rule Count
Rule Type
Community Feed
Nextron Private Feed
Yara
1094
23617
Sigma
3627
1113
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
1364
windows / registry_set
222
windows / file_event
212
windows / ps_script
168
windows / security
164
linux / process_creation
142
windows / image_load
115
webserver
86
windows / system
74
macos / process_creation
69
aws / cloudtrail
57
proxy
55
linux / auditd
54
windows / network_connection
53
azure / auditlogs
44
windows / registry_event
40
azure / activitylogs
35
windows / ps_module
33
windows / application
32
windows / dns_query
28
windows / process_access
25
opencanary / application
24
okta / okta
22
azure / riskdetection
19
windows / pipe_created
19
azure / signinlogs
18
rpc_firewall / application
17
windows / windefend
17
linux
16
linux / file_event
16
gcp / gcp.audit
16
github / audit
15
bitbucket / audit
14
windows / file_delete
13
m365 / threat_management
13
cisco / aaa
13
windows / create_remote_thread
12
windows / driver_load
10
windows / registry_delete
10
kubernetes / application / audit
10
windows / codeintegrity-operational
10
dns
10
windows / appxdeployment-server
9
antivirus
9
windows / ps_classic_start
9
windows / create_stream_hash
9
windows / firewall-as
8
windows / msexchange-management
8
windows / file_access
7
azure / pim
7
zeek / smb_files
7
windows / bits-client
7
gcp / google_workspace.admin
7
fortigate / event
7
kubernetes / audit
6
windows / dns-client
6
zeek / dns
5
jvm / application
5
linux / network_connection
5
zeek / http
5
zeek / dce_rpc
4
m365 / audit
4
macos / file_event
4
windows / taskscheduler
4
windows / sysmon
4
windows / iis-configuration
4
windows / ntlm
3
linux / sshd
3
windows / registry_add
3
gcp / google_workspace.login
3
windows / wmi_event
3
windows / powershell-classic
3
firewall
2
linux / syslog
2
windows / security-mitigations
2
windows / dns-server
2
spring / application
2
apache
2
onelogin / onelogin.events
2
windows / wmi
2
windows / applocker
2
linux / guacamole
1
windows / appmodel-runtime
1
linux / auth
1
linux / cron
1
windows / openssh
1
fortios / sslvpnd
1
juniper / bgp
1
windows / appxpackaging-om
1
cisco / syslog
1
windows / smbserver-connectivity
1
windows / process_tampering
1
windows / smbclient-connectivity
1
windows / capi2
1
windows / shell-core
1
windows / file_change
1
windows / raw_access_thread
1
nodejs / application
1
paloalto / file_event / globalprotect
1
linux / vsftpd
1
huawei / bgp
1
windows / certificateservicesclient-lifecycle-system
1
windows / microsoft-servicebus-client
1
paloalto / appliance / globalprotect
1
zeek / x509
1
windows / file_executable_detected
1
python / application
1
windows / diagnosis-scripted
1
zeek / rdp
1
windows / smbclient-security
1
windows / file_rename
1
windows / sysmon_status
1
m365 / exchange
1
zeek / kerberos
1
windows / terminalservices-localsessionmanager
1
windows / sysmon_error
1
m365 / threat_detection
1
windows / driver-framework
1
ruby_on_rails / application
1
windows
1
sql / application
1
cisco / duo
1
cisco / bgp
1
nginx
1
linux / sudo
1
velocity / application
1
windows / ldap
1
windows / dns-server-analytic
1
cisco / ldp
1
windows / lsa-server
1
windows / ps_classic_provider_start
1
windows / printservice-admin
1
database
1
linux / clamav
1
django / application
1
windows / printservice-operational
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
551
windows / registry_set
97
windows / ps_script
95
linux / process_creation
71
windows / file_event
52
windows / image_load
49
windows / security
29
windows / wmi
29
proxy
13
windows / system
13
windows / network_connection
9
windows / registry_event
8
windows / kernel-event-tracing
6
windows / ntfs
5
windows / ps_module
5
windows / dns_query
5
windows / pipe_created
4
windows / sense
4
webserver
4
windows / taskscheduler
4
windows / registry_delete
4
windows / create_remote_thread
4
macos / process_creation
3
dns
3
windows / ps_classic_script
3
windows / vhd
3
windows / application-experience
3
windows / driver_load
3
windows / hyper-v-worker
3
windows / kernel-shimengine
2
linux / Linux kernel module / THOR
2
windows / smbclient-security
2
windows / process_access
2
windows / environment variable / THOR
2
windows / windefend
2
windows / bits-client
2
windows / codeintegrity-operational
2
windows / file_access
2
linux / file_delete
2
windows / file_delete
2
linux / file_event
2
windows / file_rename
1
linux / Unix user / THOR
1
windows / amsi
1
windows / application
1
windows / audit-cve
1
windows / registry-setinformation
1
windows / firewall-as
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR