currently serving 12318 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_LNX_LOG_ForensicArtefacts_Activity_Gen_Mar21_
Detects suspicious commands used by malware or threat groups to overwrite existing data (logs/passwords)
04.03.2021
SUSP_INNUENDO_Python_Code_Executor_Mar21_1
Detects suspicious commands used by malware or threat groups to overwrite existing data (logs/passwords)
04.03.2021
LOG_APT_HAFNIUM_Exchange_Log_Traces_Mar21_
Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity
04.03.2021
MAL_Unknown_Implant_Mar21_2
Detects samples found in an implant analysis
04.03.2021
MAL_Unknown_Implant_Mar21_3
Detects samples found in an implant analysis
04.03.2021
MAL_AnitAV_Loader_Mar21_3
Detects samples found in an implant analysis
04.03.2021
MAL_Antiaris_Dropper_Mar21_1
Detects Antiaris dropper
04.03.2021
WEBSHELL_ASP_Small_Mar21_2
Detects ASP Webshells - file 91d1720c0f1901e243da4c1ba989c372cc35c930e7b17f2ec52da6c875d96cd8
03.03.2021
HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine
Detects PowerShell Oneliner in Nishang's repository
03.03.2021
APT_HAFNIUM_Forensic_Artefacts_Mar21_1
Detects forensic artefacts found in HAFNIUM intrusions
02.03.2021
EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1
Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065
02.03.2021
EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1
Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-26858
02.03.2021
HKTL_LNX_Shellcode_Loader_Mar21_1
Detects unknown shellcode loader for Linux
02.03.2021
SUSP_AMSI_Bypass_Keywords_Mar21_1
Detects characteristics of AMSI bypass methods
01.03.2021
SUSP_Payload_Keywords_Mar21_1
Detects characteristics of loaders as observed in March 21
01.03.2021
SUSP_Go_Encoded_Payloads_Mar21_1
Detects characteristics of a set of Go based loaders as observed in March 21
01.03.2021
SUSP_Script_PS1_PE_Injection_Indicators_Mar21_1
Detects suspicious script with keywords that indicate pe injection techniques
01.03.2021
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
HKTL_JS_OBFUSC_Loader_Indicators_Oct20_1
2
75580b8b18ecd77f10083222cb5e6c6dabe066a9e5585fe4dbd7b5e8d4242b01
HKTL_PS1_Hacktool_Indicator_Feb20_1
1
a0de5f72382c8c69c980d3a6cef40afacc7f970160ec222cb9b4e3c0b7bfa1f5
APT_WEBSHELL_HAFNIUM_Chopper_WebShell
7
4db73fd2ace1f29b14d0d36fb19cf619fb571371ba37f366ee7b55aa755d07b5
APT_WEBSHELL_HAFNIUM_Chopper_WebShell
8
8a4169b608fcf01b7b70b5a1d50220b9d6d65ec07affe1083a76ee6b043558a0
APT_WEBSHELL_HAFNIUM_Chopper_WebShell
8
8637860ec236ba7a672c3067909e336b716dada9efe149589793f05958862f4a
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
APT
3518
Malware
3003
Hacktools
2844
Webshells
1982
Threat Hunting
1900
Exploits
215
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR