currently serving 13989 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
LOG_EXPL_ADSelfService_CVE_2021_40539_WebLog_Sep21_1
Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539
20.09.2021
SUSP_MalDoc_OBFUSCT_HTMLEntity_Sep21_1
Detects suspicious office reference files including obfuscated http references
18.09.2021
SUSP_MalDoc_OBFUSCT_HTMLEntity_Sep21_2
Detects suspicious office reference files including obfuscated http references
18.09.2021
SUSP_MalDoc_OBFUSCT_Spaces_Sep21_1
Detects suspicious office reference files including obfuscation based on multiple spaces
18.09.2021
SUSP_MalDoc_NetworkShare_Reference_Sep21_1
Detects suspicious office reference files including a template reference on a network share
18.09.2021
SUSP_OBFUSC_Indiators_XML_OfficeDoc_Sep21_2
Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents
18.09.2021
EXPL_MAL_MalDoc_OBFUSCT_MHTML_Sep21_1
Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444
18.09.2021
VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21
Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE
16.09.2021
HKTL_VermilionStrike_Sep21_1
Detects VermilionStrike, a CobaltStrike beacon reimplementation
14.09.2021
HKTL_VermilionStrike_Sep21_2
Detects VermilionStrike, a CobaltStrike beacon reimplementation
14.09.2021
HKTL_VermilionStrike_Stager_Sep21_1
Detects a Stager for VermilionStrike, a CobaltStrike beacon reimplementation
14.09.2021
WEBSHELL_PHP_Base64_Obfuscation_Sep21
Detects Base64 variants of suspicious combinations of functions used for obfuscated webshells
14.09.2021
WEBSHELL_PHP_BeginsWith_eval_Sep21
Detects Files that begin with eval(
14.09.2021
WEBSHELL_PHP_Obfuscation_Functions_Sep21
Detects suspicious use of functions often used in obfuscated webshells
13.09.2021
SUSP_WriteLdSoPreload_Sep21
Detects a command to write a preloader library
10.09.2021
MAL_XmRig_Invocation_Sep21
Detects a command to invoke XmRig to mine Monero
10.09.2021
HKTL_ADFS_Dump_Sep21_1
Detects ADFS Dump, a tool used to dump all sorts of information from AD FS
10.09.2021
SUSP_VHDX_Files_Sep21_1
Detects suspicious VHDX files with similarities noticed in files used by TransparentTribe in September 2021
09.09.2021
SUSP_VHDX_Files_Indicators_Sep21
Detects suspicious VHDX files with suspicious contents in their filesystem
09.09.2021
SUSP_ManualHttpRequest_Sep21
Detects a script that manually builds an HTTP request (instead of e.g. using curl)
08.09.2021
SUSP_BashPiping_Sep21
Detects a shell script executing a script file that was likely processed or downloaded by another executable
08.09.2021
SUSP_DisableAppArmor_Sep21
Detects a command for the deactivation of AppArmor
08.09.2021
SUSP_DisableSeLinux_Sep21
Detects a command to persistently deactivate SELinux
08.09.2021
SUSP_PS1_IEX_Pattern_Sep21_1
Detects suspicious PowerShell IEX pattern in files
08.09.2021
SUSP_CAB_INF_Pattern_Sep21_1
Detects suspicious CAB files as used in attacks exploiting CVE-2021-40444
08.09.2021
SUSP_ClassID_Combo_Sep21_1
Detects suspicious strings found in JavaScript code used in attacks exploiting CVE-2021-40444
08.09.2021
EXPL_SUSP_MalDoc_TemplatInjection_Sep21_1
Detects suspicious template injections including an x-usc instruction - as seen in CVE-2021-40444 exploitation
08.09.2021
EXPL_ITW_CVE_2021_40444_Sep21_1
Detects obfuscated JavaScript in HTML files as used in CVE-2021-40444 exploitation noticed in September 2021
08.09.2021
SUSP_MalDoc_TemplatInjection_MHTML_Sep21_1
Detects attempts to exploit CVE-2021-40444 in MS Office template references
08.09.2021
SUSP_SCRIPT_FlushIptables_Sep21
Detects a command to remove all iptables rules
08.09.2021
SUSP_ELF_FlushIptables_Sep21
Detects a command to remove all iptables rules
08.09.2021
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_LNX_Rootkit_Indicators_Aug21_1
14
f60c1214b5091e6e4e5e7db0c16bf18a062d096c6d69fe1eb3cbd4c50c3a3ed6
SUSP_LNX_Rootkit_Indicators_Aug21_2
14
f60c1214b5091e6e4e5e7db0c16bf18a062d096c6d69fe1eb3cbd4c50c3a3ed6
APT_CN_Chinoxy_Downloader_Oct20_1
9
75dca5658bb3a054f1ade5f9f5d7315326ccb0afed92e888490d6223660e3b73
MAL_PurpleFox_ExploitKit_PS1_Loader_Apr21
12
a1cf6f10a700c70d95941497164b03b08ea63eb3b8f67d88255bf775aa564d1f
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
4378
APT
3852
Hacktools
3294
Threat Hunting
2502
Webshells
2067
Exploits
344
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR