currently serving 14198 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_LIGHTS_BOMB_Indicator_Oct21_1
Detects a string found in HVNC samples used by Kimsuky group
20.10.2021
PUA_Go_CPU_Miner_Oct21_1
Detects a Go CPU miner
20.10.2021
SUSP_APT_LightBasin_Pingg_Oct21_1
Detects samples possibly related to LightBasin / UNC1945
20.10.2021
SUSP_LNX_Hacktool_Indicator_Oct21_1
Detects an opcode sequence often found in Linux hacktools
20.10.2021
SUSP_Rundll32_By_Ordinal_Oct21_1
Detects a suspicious rundll32 invocation using an ordinal
20.10.2021
SUSP_AVE_MARIA_Indicator_Oct21_1
Detects a string found in HVNC samples used by Kimsuky group
20.10.2021
SUSP_WIN_Go_Binary_Obfuscated_Oct21_1
Detects suspicious Windows Go PE files that look as if certain common strings have been removed for obfuscation purposes
19.10.2021
APT_IR_Lyceum_INI_File_Indicators_Oct21_1
Detects characteristics of .ini fules used by Lyceum malware
18.10.2021
EXPL_Apache_ModProxy_CVE_2021_40438_Oct21_1
Detects PoC for Apache mod_proxy vulnerability CVE-2021-40438 or log entries that show the successful exploitation
18.10.2021
SUSP_BlackBone_Ref_Oct21_1
Detects executabkles with suspicious reference to BlackBone memory hacking library
18.10.2021
SUSP_CertOc_LoadDLL_Combo_Oct21_1
Detects suspicious certoc.exe use with -LoadDLL parameter
18.10.2021
SUSP_Hacktool_PoC_Strings_Oct21_1
Detects suspicious strings often found in hacktools, malware or PoC code
18.10.2021
LOG_SUSP_PS1_RDP_History_Removal_Oct21
Detects the removal of terminal server client history via powershell registry manipulation
15.10.2021
SUSP_NOP_Sled_Before_MZ_Oct21
Detects files with MZ header that are prefixed with NOP sleds
15.10.2021
HKTL_PUA_FRP_FastReverseProxy_Oct21_1
Detects fast reverse proxy PUA tool often used by threat groups
14.10.2021
WEBSHELL_ASP_ProcStart_Oct21_1
Detects web shells found in an open directory in October 2021
14.10.2021
WEBSHELL_ASPX_Popup_Oct21_1
Detects web shells found in an open directory in October 2021
14.10.2021
WEBSHELL_ASPX_FileUpload_Oct21_1
Detects web shells found in an open directory in October 2021
14.10.2021
WEBSHELL_PHP_B64_Decoder_Oct21_1
Detects web shells found in an open directory in October 2021
14.10.2021
WEBSHELL_PHP_PhpWaf2_Oct21_1
Detects web shells found in an open directory in October 2021 - file phpwaf2.php
14.10.2021
HKTL_EXPL_PoC_CVE_2016_3309_Oct21_1
Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)
13.10.2021
LOG_PUA_SysInternals_Live_Usage_Oct21_1
Detects access to online SysInternals tools using live.sysinternals.com
13.10.2021
LOG_SUSP_Suspicious_Service_Image_Loc_Oct21_1
Detects a suspicious location of a newly installed servers, very similar to PsExec
13.10.2021
SUSP_HKTL_Encoded_Oct21_1
Detects encoded strings often found in hacktools
13.10.2021
SUSP_HKTL_Hacktool_Strings_Oct21_1
Detects strings often used in exploit codes
13.10.2021
SUSP_HKTL_Encoded_Hacktool_Strings_Oct21_1
Detects encoded strings often found in exploit codes and hack tools
13.10.2021
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
EXP_MicrosoftEdge_WSHFILE_CVE_2018_8495
8
1df9c10e8abb33935631bc7455636691b7c6b78edef79f2554169a1c6a8e72ef
APT_MAL_Mask_Campaign_Certificate_String
8
1df9c10e8abb33935631bc7455636691b7c6b78edef79f2554169a1c6a8e72ef
CustomerCase_A4_APT_maliciousSystems
8
1df9c10e8abb33935631bc7455636691b7c6b78edef79f2554169a1c6a8e72ef
HKTL_LNX_Metasploit_Shell_May20_1
12
982fbe9c1177296c9df2a07a4fa26b60be05714cba69003c8e669b392c35a3e1
HKTL_LNX_Metasploit_Shell_May20_2
12
982fbe9c1177296c9df2a07a4fa26b60be05714cba69003c8e669b392c35a3e1
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
4436
APT
3902
Hacktools
3342
Threat Hunting
2587
Webshells
2080
Exploits
357
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR