currently serving 16001 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_CMD_SET_Download_Indicator_Combo_Jul22
Detects a combination of indicators often found in malicious samples
04.07.2022
SUSP_LNK_Raspberry_Robin_Jul22_1
Detects characteristics found in malicious link files used by Raspberry Robin malware
03.07.2022
SUSP_Chmod_Tmp_C_Code_Jul22
Detects source code that changes permissions of a file in /tmp folder, which is often found in Linux exploit code
02.07.2022
SUSP_MAL_Indicators_Jul22
Detects characteristics found ina certain protector / packer often used for malware
02.07.2022
HKTL_HookPasswordChange_Jul22_1
Detects a hacktool for Windows that hooks a password change
02.07.2022
MAL_PY_Agent_Crypto_Jul22_1
Detects malicious Python agents
02.07.2022
APT_MAL_CN_MustangPanda_Jul22_1
Detects characteristics found in Mustang Panda DLL samples
02.07.2022
SUSP_GO_Binary_VoidFunc_Export_Jul22
Detects a Go binary with a VoidFunc export often found in hacktools
02.07.2022
SUSP_OBFUSC_GO_Binary_Jul22
Detects an obfuscated Go binary, which can be malware, a hacktool or goodware, whose developer thought that obfuscating the binary would be a good idea
02.07.2022
SUSP_GO_Dropper_Indicators_Jul22
Detects a Go binary with strings often found in malicious droppers
02.07.2022
SUSP_SH_Downloader_Indicators_Jul22_1
Detects suspicious Bash code with characteristics found in malicious samples
02.07.2022
SUSP_TMP_SingleChar_Indicators_Jul22_1
Detects suspicious Bash code with characteristics found in malicious samples
02.07.2022
EXPL_Zimbra_Exploit_Jun22_1
Detects characteristics found in code exploit Zimbra vulnerabilities
30.06.2022
SUSP_EXPL_RTF_Indicators_Jun22_1
Detects suspicious RTF file with characteristics as found in malicious RTFs that exploit Follina like vulnerabilities
30.06.2022
APT_MAL_SnakeKeylogger_Jun22_1
Detects Snake Keylogger related samples found in report on APT34
29.06.2022
SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1
Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
29.06.2022
SUSP_RANSOM_Ransomware_Characteristics_Jun22_1
Detects characteristics often found in ransomware samples
29.06.2022
MAL_ME_HttpService_Backdoor_Jun22_1
Detects HttpService backdoor mentioned in EvilPlayout report of attacks against Iran's state broadcaster
28.06.2022
APT_ME_MAL_MuddyWater_Jun22_1
Detects MuddyWater samples
28.06.2022
SUSP_Cmdline_Set_Casing_Anomaly_Jun22
Detects suspcious casing of the set command
28.06.2022
SUSP_MAL_Indicator_Jun22_1
Detects characteristics found in malicious .NET compiled executables
28.06.2022
HKTL_LSASS_Dump_SilentProcessExit_Jun22_1
Detects tool that dumps the LSASS process memory using WerFault
27.06.2022
HKTL_LsassSilentProcessExit_Jun22_1
Detects LSASS process dumper samples
27.06.2022
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_PS1_IEX_TextEncoding_Pattern_Feb22_1
3
25282f8b40e63b6be05b70ff4f8853cc5dae55d1afd03a2de6a3f07d99726181
Cobaltbaltstrike_Beacon_XORed_x86
14
89995a75b253a998f5455cace7445d6ab292016e0b0dd57082d355b21c3d583b
SUSP_Encoded_GetCurrentThreadId_Ext1
1
22b6f231e76727f8851c59d2236f304af67627fba9d2b689b4a08381b7ef67b3
SUSP_Double_Base64Encoded_Kernel32_Functions
1
22b6f231e76727f8851c59d2236f304af67627fba9d2b689b4a08381b7ef67b3
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
4917
APT
4271
Hacktools
3717
Threat Hunting
3408
Webshells
2122
Exploits
472
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR