currently serving 17241 YARA rules and 2668 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
HKTL_CyUpdate_Loader_Nov22_1
Detects samples that could be loaders for NightHawk C2 implants
23.11.2022
HKTL_SMBScan_PingCastle_Scanner_Nov22_1
Detects PingCastle SMB Scanner
23.11.2022
MAL_NET_Loader_Nov22_1
Detects unknown .NET loader
23.11.2022
SUSP_Signed_VBS_Payload_Nov22_1
Detects characteristics as found in suspicious VBS scripts found in campaigns using ISO images
23.11.2022
HKTL_ReverseShell_Loaders_Nov22_1
Detects reverse shell loaders (mostly Metasploit)
23.11.2022
HKTL_ShellCode_Loaders_Nov22_1
Detects reverse shell loaders
23.11.2022
SUSP_ShellCode_Indicator_Nov22_1
Detects simple shell codes
23.11.2022
SUSP_ShellCode_Indicator_Nov22_2
Detects simple reverse shell codes
23.11.2022
SUSP_ShellCode_Indicator_Nov22_3
Detects simple reverse shell codes
23.11.2022
SUSP_Unknown_Loader_Nov22_1
Detects samples with characteristics as found in unknown loaders
22.11.2022
SUSP_NightHawk_Characteristics_Nov22_2
Detects characteristics found in NightHawk C2 loaders
22.11.2022
SUSP_OpCode_Indicator_Nov22_1
Detects samples with opcode sequences found in malicious samples
22.11.2022
SUSP_NightHawk_Characteristics_Nov22_3
Detects characteristics found in NightHawk C2 loaders
22.11.2022
SUSP_Nop_Export_Nov22
Detects suspicous DLL files with an export often found in malicious samples
22.11.2022
HKTL_NightHawk_Characteristics_Nov22_1
Detects characteristics found in NightHawk C2 loaders
22.11.2022
HKTL_NightHawk_Indicators_Nov22_1
Detects samples with characteristics as found in NightHawk loaders
22.11.2022
HKTL_DarkLoadLibrary_Indicators_Nov22_1
Detects samples with characteristics as found in DarkLoadLibrary
22.11.2022
SUSP_LNX_Indicators_Nov22_1
Detects indicators found in unknown malicious crond
21.11.2022
SUSP_TASK_Users_Public_Nov22
Detects commands in scheduled task definitions that point to the Users/Public folder
21.11.2022
SUSP_PS1_Indicators_Nov22
Detects indicators found in malicious PowerShell loaders
21.11.2022
SUSP_AppData_PathTraversal_Nov22_1
Detects suspicious path traversal from AppData folder to get into the User folder
21.11.2022
MAL_LNX_Mirai_Nov22_1
Detects Mirai malware
21.11.2022
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_JDNIExploit_Indicators_Dec21
6
7d26c10c14d10cc8831b98c842c08ca19a50f6224005c9ce42824ea32166e639
SUSP_Casing_Anomaly_Env_Computername_Nov21
11
0bbceaa5615f5c0880c84474167425291e93fc44b1d48345a135983b1e8db294
SUSP_JS_Document_Write_Unescape_Indicators_Mar22_1
1
579c144e4079ddb2f90daa0bae3ec6bcf87fcbb6f13ec0910fb767b03b7de566
SUSP_OBFUSC_JS_DocWriteUnescape_Aug19_2
1
579c144e4079ddb2f90daa0bae3ec6bcf87fcbb6f13ec0910fb767b03b7de566
SUSP_Administrator_Desktop_Reference
3
83d65210d041d8fc29b5105ad4377fe2b5c622f223ba7bca7d75e76ba98d446f
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
6611
APT
4525
Hacktools
4407
Threat Hunting (not subscribable, only in THOR scanner)
3926
Webshells
2203
Exploits
731
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
UAC Bypass Using Event Viewer RecentViews
Detects the pattern of UAC Bypass using Event Viewer RecentViews
22.11.2022
Microsoft Exchange ProxyNotShell Exploit Traffic
Detects Microsoft Exchange exploit traffic for CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell)
21.11.2022
Microsoft Exchange ProxyNotShell Exploit Traffic
Detects Microsoft Exchange exploit traffic for CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell)
21.11.2022
NET NGenAssemblyUsageLog Registry Key Tamper
Detects changes to the NGenAssemblyUsageLog registry key.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
18.11.2022
Cmd.Exe Execution With Uncommon Flag
Detect use of "/R" flag which is the same as "/C". This flag is often used for obfsucation and should be investigated
18.11.2022
NET CLR Binary Execution Usage Log Artifact
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context
18.11.2022
Suspicious Powercfg Execution To Change Lock Screen Timeout
Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout
18.11.2022
Suspicious Windows Defender Exclusions Added - PowerShell
Detects execution of the PowerShell "Add-MpPreference" or "Set-MpPreference" cmdlets to add dangerous exclusions to Windows Defender
17.11.2022
Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
17.11.2022
Microsoft Exchange ProxyNotShell Exploit
Detects Microsoft Exchange exploit for CVE-2022-41040 and CVE-2022-41082 (A.K.A ProxyNotShell)
17.11.2022
Microsoft Exchange Pool Exploit
Detects Microsoft Exchange exploit abusing Exchange pools
17.11.2022
PST Export Alert Using New-ComplianceSearchAction
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
17.11.2022
Suspicious Msbuild Execution By Uncommon Parent Process
Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process
17.11.2022
Suspicious Windows Defender Exclusions Added
Detects execution of the PowerShell "Add-MpPreference" or "Set-MpPreference" cmdlets to add dangerous exclusions to Windows Defender
17.11.2022
Suspicious Tasks Running System Processes
Detects suspicious execution of scheduled tasks with processes masquerading as system processes
17.11.2022
User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
17.11.2022
Process Hacker and System Informer Driver Load
Detects the load of drivers used by Process Hacker and System Informer
16.11.2022
Suspicious Creation Of Rnasom Note Files
Detects the creation of files with a known ransom note name
16.11.2022
Suspicious Creation Of File With Ransomware Extensions
Detects the creation of files with an extension known to be used by ransomware
14.11.2022
Possible Process Injection Into System Processes
Detects cmd or powershell processes with suspicious arguments being children of system processes. This could be a sign of process injection
14.11.2022
Suspicious RunAs-Like Flag Combination
Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
11.11.2022
Use Of The SFTP.EXE Binary As A LOLBIN
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
10.11.2022
Vulnerable Lenovo Driver Load
Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges
10.11.2022
Computer Discovery And Export Via Get-ADComputer Cmdlet
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
10.11.2022
Suspicious Sysmon as Execution Parent
Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)
10.11.2022
Renamed PuTTY Secure Copy Execution
Detects execution of a renamed PuTTY Secure Copy (PSCP)
10.11.2022
PuTTY Secure Copy Suspicious Usage
Detects suspicious usage of PuTTY Secure Copy (PSCP) to exilftrate file
10.11.2022
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
970
windows / security
148
windows / ps_script
146
windows / registry_set
141
windows / file_event
121
windows / system
59
webserver
56
linux / process_creation
51
windows / image_load
51
linux / auditd
50
azure / activitylogs
38
windows / network_connection
36
proxy
35
windows / registry_event
35
azure / auditlogs
33
macos / process_creation
32
aws / cloudtrail
31
windows / ps_module
30
windows / process_access
25
azure / signinlogs
22
windows / application
19
rpc_firewall / application
17
windows / pipe_created
17
linux
16
windows / driver_load
15
gcp / gcp.audit
14
m365 / threat_management
13
windows / dns_query
13
okta / okta
12
cisco / accounting / aaa
12
dns
12
windows / create_remote_thread
12
windows / registry_add
10
windows / ps_classic_start
10
windows / windefend
9
windows / file_delete
8
windows / msexchange-management
8
antivirus
7
zeek / smb_files
7
windows / create_stream_hash
7
windows / registry_delete
6
windows / bits-client
6
firewall
6
windows / firewall-as
6
google_workspace / google_workspace.admin
6
azure / azureactivity
5
zeek / dce_rpc
5
linux / file_create
5
windows / file_access
4
zeek / dns
4
apache
3
windows / sysmon
3
windows / codeintegrity-operational
3
windows / wmi_event
3
windows / powershell-classic
3
zeek / http
3
linux / network_connection
3
windows / ntlm
3
linux / sshd
2
linux / syslog
2
onelogin / onelogin.events
2
windows / security-mitigations
2
windows / file_change
2
qualys
2
windows / file_rename
2
macos / file_event
2
windows / smbclient-security
2
linux / auth
2
windows / dns-server
2
windows / openssh
1
m365 / threat_detection
1
zeek / kerberos
1
windows / printservice-operational
1
linux / clamav
1
windows / printservice-admin
1
windows / raw_access_thread
1
python / application
1
linux / guacamole
1
django / application
1
windows / webserver
1
windows / microsoft-servicebus-client
1
ruby_on_rails / application
1
linux / vsftpd
1
windows / shell-core
1
spring / application
1
windows / applocker
1
windows / file_block
1
sql / application
1
netflow
1
windows / terminalservices-localsessionmanager
1
windows / diagnosis-scripted
1
windows / process_tampering
1
linux / cron
1
windows / taskscheduler
1
windows / sysmon_status
1
windows
1
windows / ps_classic_provider_start
1
windows / sysmon_error
1
microsoft365portal / auditlogs
1
windows / driver-framework
1
linux / sudo
1
zeek / x509
1
windows / wmi
1
linux / modsecurity
1
windows / ldap_debug
1
windows / powershell
1
m365 / exchange
1
zeek / rdp
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
98
windows / ps_script
26
windows / registry_set
13
windows / file_event
9
windows / system
6
windows / security
4
windows / registry_event
3
windows / create_remote_thread
3
windows / image_load
3
proxy
2
webserver
2
windows / vhd
2
windows / pipe_created
2
windows / process_access
1
windows / registry_delete
1
windows / application
1
windows / registry-setinformation
1
windows / dns_query
1
windows / file_access
1
windows / file_delete
1
windows / driver_load
1
windows / network_connection
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR