currently serving 24513 YARA rules and 4709 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
MAL_RANSOM_BytetoBreach_Aug26
Detects a ransomware associated with the ByteToBreach threat actor, potentially a variant of BytetoCrypt ransomware.
19.08.2026
SUSP_JS_Downloader_Cscript_Aug26
Detects JavaScript executing another downloaded JavaScript file via Windows Script Host
19.08.2026
SUSP_VSIX_Silent_MCP_Install_Aug26
Detects Visual Code extensions that silently register a MCP server on activation
19.08.2026
SUSP_VSIX_Load_Local_Module_On_Activation_Aug26_2
Detects Visual Code extensions that run an export function of a local module on activation
19.08.2026
SUSP_VSIX_Fingerprint_On_Activation_Aug26
Detects Visual Code extensions that fingerprint user on activation
19.08.2026
SUSP_OBFUSC_JS_NullReceiver_Aug26
Detects obfuscated JavaScript patterns seen being used by Lazarus Group (DPRK) in NullReceiver and PolinRider campaigns
17.08.2026
HKTL_NocturneLdr_Aug26
Detects NocturneLdr, a CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injection, and inverted function table collapse
17.08.2026
SUSP_PPKG_Archive_Aug26
Detects XML files from PPKG packages which execute commands via cmd.exe or PowerShell
17.08.2026
APT_MAL_CoolClient_Loader_Aug26
Detects CoolClient loader, seen being used by HoneyMyte APT group
17.08.2026
MAL_Nidhogg_Rootkit_Aug26
Detects Nidhogg rootkit that hides files, processes, and registry keys, and provides backdoor access to the compromised system, seen being used by HoneyMyte APT group
16.08.2026
SUSP_VBS_Stager_Aug26
Detects VBScript stager that checks the OS build number, expands environment variables, and verifies file existence before staging or executing an additional payload, seen being used by Darkhotel APT group
14.08.2026
MAL_CobaltStrike_Beacon_Loader_Aug26
Detects Cobalt Strike beacon loader
14.08.2026
EXPL_LOG_CVE_2026_55040_Aug26
Detects potential exploitation of CVE-2026-55040 against vulnerable, unpatched Microsoft SharePoint Server installations by identifying suspicious JWT authentication activity in ULS logs. A match alone indicates an exploitation attempt. To confirm successful exploitation, use the matched entry correlation ID to locate a subsequent 'Authentication finished successfully for user' event and, where available, a successful HTTP response for the same request.
14.08.2026
SUSP_Win_Kernel_Driver_Defense_Evasion_Aug26
Detects Windows kernel drivers with defense-evasion capabilities
13.08.2026
MAL_APT_Lazarus_Encrypted_PDF_Aug26
Detects a PDF that contains encrypted Troy backdoor payload
13.08.2026
SUSP_PS_Downloader_Aug26
Detects PowerShell downloader that downloads remote content and subsequently executes payload with msiexec, seen being used by Darkhotel APT group
13.08.2026
HKTL_ShieldBreak_LPE_Aug26
Detects the ShieldBreak proof-of-concept for a Windows Defender local privilege-escalation vulnerability. ShieldBreak manipulates Cloud Files placeholder hydration and Object Manager symbolic links during Defender remediation to redirect a privileged file operation and plant an attacker-controlled DLL in the Windows System32 directory, which is subsequently loaded through Windows Error Reporting.
12.08.2026
MAL_APT_Lazarus_Blassult_Loader_Aug26
Detects Blassult loader, a loader used by Lazarus APT to load MISTPEN downloader module in memory.
12.08.2026
MAL_APT_Lazarus_MISTPEN_ShellCode_Aug26
Detects MISTPEN ShellCode, a fileless downloader module used by Lazarus APT to download and execute other payloads in memory.
12.08.2026
MAL_APT_Lazarus_Dropper_Aug26
Detects a dropper used to drop Troy backdoor loader, seen being used by Lazarus APT
12.08.2026
MAL_APT_Lazarus_Troy_Backdoor_Loader_Aug26
Detects a loader used to load Troy backdoor in memory, seen being used by Lazarus APT
12.08.2026
MAL_APT_Lazarus_Troy_Backdoor_Aug26
Detects Troy backdoor, a fileless backdoor, seen being used by Lazarus APT
12.08.2026
HKTL_ResetNightMare_Aug26
Detects ResetNightMare vulnerability POC, that allows an attacker to reset the password of any user in Active Directory, including domain admins creating a new path for escalation.
12.08.2026
SUSP_NET_OBFUS_Unsigned_Legitimate_Publisher_Aug26
Detects heavily obfuscated .NET executables that are unsigned but claim to be from a legitimate publisher. This is often a sign of malware masquerading as a trusted application. False positives are possible, for catalog signed files or repackaged official dependencies.
12.08.2026
MAL_NET_Snake_Loader_Aug26
Detects a .NET based loader that loads a command and control agent called Snake, it is often masquerading as a module of a legitimate application like Git Credential Manager.
12.08.2026
MAL_NET_Snake_Agent_Aug26
Detects a .NET based command and control agent called Snake, it blends in as a module of a legitimate application and is used to execute commands and maintain persistent access on the infected host.
12.08.2026
MAL_Abyssos_RAT_Aug26
Detects Abyssos RAT which enable remote administration, VNC control, file management, system information collection, and data collection.
11.08.2026
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_LNX_Malware_Indicators_Mar23_4
14
3aec258b2b5917f68a71d0109d306b94f765a662785879040ea0dd490530ac86
PUA_ConnectWise_ScreenConnect_Mar23
8
916c41d45e2c1c8f4fb806426671bbc937248aedd09fb388ee338d571585ae8a
PUA_ConnectWise_ScreenConnect_Mar23
10
b591e59ee7a6424309496db6941ff230ebc82f9bbb440a198d1f6036b18586e2
SUSP_LNX_Malware_Indicators_Mar23_4
14
5e3bad19dcae1ad6b34ed1af1a20257b493714ed95200cc108c9ba26c82b0325
SUSP_Base64_Obfuscated_Batch_Script_Apr25
1
a834dc0dd0c79df8ae758cdc2dd548bb2d9898a18210e23e8eab5ef17b9d848d
PUA_ConnectWise_ScreenConnect_Mar23
7
2267411053ed30d73eca58b5b0ac7f8a5442db7235a48911998ea920dffa32d8
SUSP_LNX_OBFUSC_Base64_Encoded_Bash_Commands_Mar23_1
10
1e2ee25b8ce2cf7052b9c6a84ed1ed47c404d9d9b4367cc8967a2a5c4a41673b
EXP_MicrosoftEdge_WSHFILE_CVE_2018_8495
10
1e2ee25b8ce2cf7052b9c6a84ed1ed47c404d9d9b4367cc8967a2a5c4a41673b
HKTL_Nim_Shellcode_Loaders_Jul22_1
7
4a0c111d5ccf1f5aea59a120ad5e7764b24d52df001acf92c13bef9c419002dc
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
7851
Threat Hunting (not subscribable, only in THOR scanner)
6031
APT
5092
Hacktools
4899
Webshells
2405
Exploits
749
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
SSH Known Hosts File Deleted
Detects deletion of SSH known_hosts files via file deletion events.
Complements the proc_creation variant by catching cases where the shell handles
the operation directly (e.g. bare redirects, unlink syscalls) without spawning
a traceable child process.
Attackers remove known_hosts to erase lateral movement destinations and suppress
SSH host key mismatch warnings.
19.08.2026
Logging Daemon Force Killed via CommandLine
Detects use of kill, killall, pkill, or other command line methods to forcefully terminate
common Linux logging and auditing services. Threat actors or malware may use this technique
to silence audit trails before encryption or exfiltration.
19.08.2026
Linux Log File Content Cleared or Deleted via CLI Utilities
Detects unusual CLI-based methods to clear or delete Linux log file contents, including
truncating to zero size, overwriting with /dev/null, and other methods. These techniques
are commonly used by attackers and ransomware to destroy forensic evidence before or after
malicious activity.
19.08.2026
Logging Service Stopped via Service Command
Detects use of the legacy service command to stop common Linux logging and auditing services. The service
command wraps SysV init scripts and remains functional on systemd-based distributions via compatibility shims.
Attackers use this to stop logging with a command that blends into older administration patterns.
19.08.2026
SSH Known Hosts File Removed or Cleared
Detects removal or clearing of SSH known_hosts files via common CLI utilities.
Attackers delete known_hosts to erase evidence of lateral movement destinations and to
suppress SSH host key mismatch warnings when reconnecting to a host whose key has been changed.
19.08.2026
Logging Service Stopped or Disabled via Systemctl
Detects use of systemctl to stop, kill, mask, or disable common Linux logging and auditing services (rsyslog, syslog-ng, auditd, systemd-journald).
Attackers and ransomware use this to silence audit trails before encryption or exfiltration.
Masking a service additionally prevents it from being restarted by other processes.
19.08.2026
PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
19.08.2026
New User Account Creation Attempt Via ADSI
Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
13.08.2026
New User Account Creation Attempt Via ADSI in CommandLine
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
13.08.2026
PowerShell Live Kernel Dump
Detects PowerShell scripts or commands that create live kernel dumps.
While live kernel dumps are a legitimate diagnostic mechanism, they are increasingly
abused by threat actors to read sensitive process memory such as LSASS without opening
a direct process handle, bypassing traditional process-access based detections.
10.08.2026
Live Kernel Dump via CommandLine
Detects live kernel dumps initiated via the command line.
While kernel dumps are not inherently malicious, these dumps can be accessed
to read sensitive process memory such as LSASS without opening a direct process
handle, bypassing traditional process-access based detections.
10.08.2026
Potential Crontab Persistence via CLI
Detects command lines attempting to install a crontab persistence via cli by echoing a cron schedule and piping it to 'crontab -' via stdin.
Attackers may use this technique to establish persistence on a compromised system by scheduling malicious tasks to run at regular intervals.
07.08.2026
Sensitive File Discovery via Find Command
Detects aggressive filesystem searches for credential, certificate, and wallet files using the 'find' command.
This behavior may indicate an adversary attempting to locate sensitive files such as environment variable files, private keys, certificates, or wallet files that could be used for credential access or further compromise.
07.08.2026
Suspicious Grep of Sensitive Contents for Credential Access
Detects the use of grep to search for sensitive credentials and cryptocurrency wallet mnemonics.
This behaviour may indicate an adversary trying to to locate sensitive credentials contained in environment variable files, private keys, certificates, wallet files, or other files that may contain secrets which could be used for credential access or further compromise.
07.08.2026
PostgreSQL Connection String Enumeration via Grep
Detects the use of grep to search for PostgreSQL connection strings and database URLs, which may indicate credential harvesting from application directories as a precursor to lateral movement or data exfiltration.
Attackers may use this technique to find hardcoded database credentials in source code, configuration files, or environment variable definitions.
07.08.2026
Node.Js Inline Script Network Connection - Linux
Detects inline Node.js scripts that establish network connections, which may indicate malicious activity such as data exfiltration or command-and-control communication.
Attackers may use inline Node.js scripts to quickly execute code that interacts with the network without leaving a persistent file on disk.
07.08.2026
Suspicious Node.js Child Process with IP Address - Linux
Detects a Node.js process spawning a shell or network utility with a command line containing an IPv4 address.
This pattern is commonly used by malicious npm postinstall scripts to download second-stage payloads or establish reverse shells, as observed in various malicious Strapi npm campaign.
07.08.2026
Container Overlay Filesystem Enumeration via Mount - Linux
Detects processes enumerating overlay filesystems by piping mount output through grep for "overlay".
This technique is used by attackers to detect if they are running inside a container (e.g., Docker, Podman),
which is a common precursor to container escape attempts or environment-aware malware behaviour.
07.08.2026
Node.Js Inline Script Network Connection
Detects inline Node.js scripts that establish network connections, which may indicate malicious activity such as data exfiltration or command-and-control communication.
Attackers may use inline Node.js scripts to quickly execute code that interacts with the network without leaving a persistent file on disk.
07.08.2026
Suspicious Node.js Child Process with IPv4 Address
Detects a Node.js child process command line containing an IPv4 address.
This might indicate a malicious npm postinstall script downloading second-stage payloads or establishing reverse shells, as observed in various malicious npm campaigns or supply chain attacks.
07.08.2026
ADCS - Certighost Ghost Machine Account Creation
Detects the creation of a machine account whose name starts with 'GHOST', which is the
naming convention used by the CVE-2026-54121 (Certighost) exploit tooling.
The public proof-of-concept for Certighost creates a temporary machine account with a
name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase
path. The attacker-controlled machine account is used as the requester identity in the
certificate request; the cdc attribute then redirects the CA to a rogue host that returns
a forged Domain Controller identity. The resulting certificate carries the DC's SID and
DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.
A machine account creation event (4741) where TargetUserName starts with 'GHOST' and
ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate
environments very rarely provision machine accounts with this prefix.
30.07.2026
ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)
Detects Active Directory Certificate Services (ADCS) certificate requests that include the
'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller.
'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest
scenarios where a client in a child domain tells the CA which DC to contact for identity
lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames
or IPs that resolve to a real Domain Controller computer object in AD with the
SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set.
In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their
rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC
identity which the pre-patch CA accepts without validation. A malicious event looks like:
Requester: DOMAIN\GHOST<random>$
Attributes: cdc:<attacker_ip>
rmd:<target_dc_fqdn>
SubjectAlternativeName: DNS Name=<target_dc_fqdn>
CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added
_ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate
DC object in Active Directory before following the chase.
27.07.2026
ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)
Detects successful issuance of an ADCS certificate where the request attributes include
'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the
CA's chase fallback path was taken against an attacker-controlled target.
'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to
look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that
returns a forged DC identity. A successfully issued certificate at this stage means the
attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling
PKINIT authentication as that DC followed by DCSync replication.
27.07.2026
Registry Hive File Staged Outside Standard User Profile Path
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
23.07.2026
Suspicious Cross-User Process Spawn
Detects suspicious spawning of a process under a different user context than the parent process.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
23.07.2026
Potentially Suspicious Image Load of Offreg.dll
Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
23.07.2026
Potentially Suspicious Explicit Credential Local Logon
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
23.07.2026
AppDomainManager Environment Variable Hijack - PsScript
Detects the usage of environment variables related to the .NET AppDomainManager within PowerShell scripts.
The presence of these variables in script content may indicate attempts to hijack the AppDomainManager,
allowing adversaries to execute malicious code within trusted processes.
Setting these variables in scripts can force legitimate .NET applications to load attacker-controlled assemblies,
enabling stealthy code execution and persistence.
20.07.2026
AppDomainManager Environment Variable Hijack
Detects the use of environment variables related to the .NET AppDomainManager,
which can be hijacked by adversaries to execute malicious code within trusted processes.
Adversaries can set these variables to point to a malicious assembly, forcing legitimate
.NET applications to load it upon startup.
This technique allows for stealthy code execution within trusted, signed processes.
20.07.2026
Modification of AppDomain Manager Environment Variables
Detects modification of AppDomain Manager environment variables in the registry,
which can be abused to hijack .NET AppDomain Manager.
Adversaries can set these variables to point to a malicious assembly, causing any legitimate
.NET applications to load it upon startup, enabling stealthy code execution.
20.07.2026
YARA/SIGMA Rule Count
Rule Type
Community Feed
Nextron Private Feed
Yara
1390
23123
Sigma
3617
1092
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
1359
windows / registry_set
219
windows / file_event
211
windows / ps_script
167
windows / security
164
linux / process_creation
142
windows / image_load
115
webserver
86
windows / system
74
macos / process_creation
69
aws / cloudtrail
57
proxy
55
linux / auditd
54
windows / network_connection
53
azure / auditlogs
44
windows / registry_event
40
azure / activitylogs
35
windows / ps_module
33
windows / application
32
windows / dns_query
28
windows / process_access
25
opencanary / application
24
okta / okta
22
azure / riskdetection
19
windows / pipe_created
19
azure / signinlogs
18
rpc_firewall / application
17
windows / windefend
17
linux
16
linux / file_event
16
gcp / gcp.audit
16
github / audit
15
bitbucket / audit
14
windows / file_delete
13
m365 / threat_management
13
cisco / aaa
13
windows / create_remote_thread
12
windows / driver_load
10
windows / registry_delete
10
kubernetes / application / audit
10
windows / codeintegrity-operational
10
dns
10
windows / appxdeployment-server
9
antivirus
9
windows / ps_classic_start
9
windows / create_stream_hash
9
windows / firewall-as
8
windows / msexchange-management
8
windows / file_access
7
azure / pim
7
windows / bits-client
7
gcp / google_workspace.admin
7
zeek / smb_files
7
fortigate / event
7
kubernetes / audit
6
windows / dns-client
6
jvm / application
5
zeek / dns
5
linux / network_connection
5
zeek / http
5
zeek / dce_rpc
4
m365 / audit
4
macos / file_event
4
windows / taskscheduler
4
windows / sysmon
4
windows / iis-configuration
4
linux / sshd
3
windows / registry_add
3
gcp / google_workspace.login
3
windows / wmi_event
3
windows / powershell-classic
3
windows / ntlm
3
windows / security-mitigations
2
linux / syslog
2
windows / dns-server
2
spring / application
2
apache
2
windows / wmi
2
onelogin / onelogin.events
2
windows / applocker
2
firewall
2
fortios / sslvpnd
1
linux / cron
1
juniper / bgp
1
windows / openssh
1
windows / process_tampering
1
cisco / syslog
1
huawei / bgp
1
windows / appxpackaging-om
1
windows / smbclient-connectivity
1
windows / smbserver-connectivity
1
windows / file_change
1
windows / raw_access_thread
1
nodejs / application
1
paloalto / file_event / globalprotect
1
windows / capi2
1
windows / shell-core
1
paloalto / appliance / globalprotect
1
linux / vsftpd
1
windows / certificateservicesclient-lifecycle-system
1
python / application
1
zeek / x509
1
windows / microsoft-servicebus-client
1
windows / file_executable_detected
1
windows / diagnosis-scripted
1
windows / smbclient-security
1
windows / file_rename
1
windows / sysmon_error
1
m365 / exchange
1
zeek / rdp
1
windows / terminalservices-localsessionmanager
1
windows / sysmon_status
1
velocity / application
1
zeek / kerberos
1
m365 / threat_detection
1
windows / driver-framework
1
ruby_on_rails / application
1
windows
1
linux / sudo
1
sql / application
1
cisco / duo
1
cisco / ldp
1
nginx
1
windows / ps_classic_provider_start
1
windows / dns-server-analytic
1
cisco / bgp
1
windows / ldap
1
windows / printservice-operational
1
database
1
windows / lsa-server
1
windows / printservice-admin
1
linux / guacamole
1
django / application
1
linux / auth
1
linux / clamav
1
windows / appmodel-runtime
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
537
windows / registry_set
95
windows / ps_script
91
linux / process_creation
71
windows / file_event
52
windows / image_load
48
windows / security
29
windows / wmi
29
proxy
13
windows / system
13
windows / network_connection
9
windows / registry_event
8
windows / kernel-event-tracing
6
windows / ntfs
5
windows / ps_module
5
windows / dns_query
5
windows / sense
4
webserver
4
windows / pipe_created
4
windows / taskscheduler
4
windows / create_remote_thread
4
windows / registry_delete
4
macos / process_creation
3
dns
3
windows / ps_classic_script
3
windows / vhd
3
windows / application-experience
3
windows / hyper-v-worker
3
windows / driver_load
3
windows / kernel-shimengine
2
linux / Linux kernel module / THOR
2
windows / smbclient-security
2
windows / windefend
2
windows / process_access
2
windows / bits-client
2
windows / codeintegrity-operational
2
linux / file_delete
2
windows / file_delete
2
linux / file_event
2
windows / file_access
2
windows / file_rename
1
windows / environment variable / THOR
1
linux / Unix user / THOR
1
windows / posh_ps
1
windows / application
1
windows / audit-cve
1
windows / registry-setinformation
1
windows / firewall-as
1
windows / amsi
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR