New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_Ncat_Like_Cmd
Detects a cmd.exe run via -e parameter, as used in ncat to execute certain binaries
25.02.2020
>
MAL_Netsha_Feb20_1
Detects Netsha malware
24.02.2020
WEBSHELL_PHPEval_Feb20
Detects a Webshell that hides as a hexdump
21.02.2020
WEBSHELL_CloakedAsPic_Feb20
Detects an webshell that is cloaked as a picture
21.02.2020
SUSP_ComSvcs_DLL_MiniDump_CommandLine
Detects a suspicious command line making use of comsvcs.dll's exported function MiniDump to dump a process' memory
18.02.2020
>
SUSP_JS_Var_A_HTTP_Header_Feb20_1
Detects a JavaScript file starting with a variable declaration and URL
18.02.2020
>
Webshell_Unknown_Feb20_18
Detects an unknown webshell
18.02.2020
Webshell_ASPSpyder_Feb20_1
Detects ASPSpyder webshell
18.02.2020
Webshell_PHP_Feb20_17
Detects obfuscated PHP webshell
18.02.2020
Webshell_Unknown_Feb20_4
Detects an unknown webshell
18.02.2020
Webshell_Unknown_Feb20_3
Detects an unknown webshell
18.02.2020
Webshell_Unknown_Feb20_2
Detects an unknown webshell
18.02.2020
Webshell_Unknown_Feb20_1
Detects an unknown webshell
18.02.2020
Webshell_Unknown_ASP_Feb20_1
Detects unknown ASP webshell
18.02.2020
Webshell_Unknown_ASPX_Feb20_1
Detects unknown ASPX webshell
18.02.2020
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
MAL_MetaSploit_Android_Stage_Jul19
12
44309b994f9cca2ea6a9527a999fb25c7c6f21a8f2c77216d2fb58d378f299bd
>
SUSP_AutoIt_Malware_Indicator_1
6
cd5137093dd27199943859c7f5d426a94cf0917ff6a555b037841aa977a46fe4
>
SUSP_Administrator_Desktop_Reference
2
4ed92c77fb58bf275adf604e007bc85bba3649e981a151d38b1966047dbdb480
>
SUSP_Administrator_Desktop_Reference
9
36dcc9fe05b1d87d09e30d544a198837edd0e1c1c43a3352e4dac8630d43ba4d
>
Top Tags in YARA Rule Set
This list shows the top tags used in our database, which are used for the subscribable categories
Tag
Count
FILE
6677
EXE
4764
APT
2837
MAL
2800
HKTL
2559
DEMO
2446
T1100
1894
WEBSHELL
1863
SUSP
1379
CHINA
1042
SCRIPT
695
RUSSIA
409
T1086
399
MIDDLE_EAST
362
T1027
337
T1064
312
GEN
308
T1003
281
T1193
259
T1203
259
T1075
212
OBFUS
175
T1132
174
EXPLOIT
164
T1085
155
LINUX
151
T1178
139
T1097
139
METASPLOIT
114
T1050
112
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls