currently serving 24178 YARA rules and 4607 Sigma rules
API Key
New Rules per Day
Newest YARA Rules
This table shows the newest additions to the YARA rule set
Rule
Description
Date
Ref
EXPL_CVE_2026_33829_Jun26
Detects CVE-2026-33829 exploit that allows remote attackers to disclose NTLM responses from users using ms-screensketch protocol handlers
09.06.2026
EXPL_B64_CVE_2026_33829_Jun26
Detects CVE-2026-33829 exploit base64 encoded, that allows remote attackers to disclose NTLM responses from users using ms-screensketch protocol handlers
09.06.2026
SUSP_Binding_GYP_Jun26
Detects suspicious build configuration files containing shell command execution constructs that may be abused during npm package installation, as these files are automatically processed by node gyp in trusted build environments.
04.06.2026
APT_DPRK_RAT_HuggingFace_Exfil_Jun26
Detects JavaScript RAT, seen being used by DPRK Contagious Interview exfiltrating screenshots and files via HuggingFace API
03.06.2026
EXPL_WER_CVE_2026_41089_Netlogon_Jun26
Detects characteristics in WER files (crash reports) that could indicate exploitation of CVE-2026-41089, a critical vulnerability in Microsoft Windows Netlogon that allows for remote code execution through a stack-based buffer overflow in the BuildSamLogonResponse function. The presence of specific strings related to lsass.exe, netlogon.DLL, and certain error codes could be indicative of an attempted or successful exploitation of this vulnerability.
02.06.2026
MAL_MWSRAT_Jun26
Detects MWSRAT that searches the host for cryptocurrency wallets, performs local network scanning, queries the registry, and hijacks the clipboard to swap copied cryptocurrency addresses
01.06.2026
SUSP_LNX_CRONTAB_INSTALL_Jun26
Detects suspicious installation of crontab entries for persistence
01.06.2026
MAL_RUSTCLOAK_Loader_Jun26
Detects RUSTCLOAK loader that evades sandbox analysis, decrypts an encoded shellcode payload, and executes it via fiber hijacking.
01.06.2026
SUSP_JS_OBFUSC_Caesar_Cipher_Jun26
Detects obfuscated JavaScript that decodes a Caesar-ciphered, char-code-encoded payload at runtime and executes it
01.06.2026
SUSP_LNX_ETC_SHADOW_IO_URING_Jun26
Detects suspicious access to /etc/shadow using io_uring syscalls
01.06.2026
MAL_PY_Crypto_Market_Beaconing_May26
Detects a script written in Python that collects cryptocurrency prices from multiple exchanges while communicating with an external untrusted domain, potentially indicating a disguised data collection agent.
29.05.2026
MAL_MacOS_Stealer_May26
Detects stealer written in Rust that targets chromium browser data, Telegram sessions, cryptocurrency wallets, apple notes, and the macOS keychain, uses AppleScript for password prompting, stages stolen data into a ZIP archive, and exfiltrates it externally.
29.05.2026
MAL_Bash_Loader_May26
Detects a macOS Bash loader that downloads and launches decoy applications, removes macOS security attributes, executes secondary payloads
28.05.2026
MAL_AMSI_Bypass_May26
Detects .NET binaries attempting AMSI evasion via hardware breakpoints (DRx registers)
28.05.2026
MAL_GO_DNS_Backdoor_May26
Detects a backdoor in Golang code which executes arbitrary commands via DNS TXT lookups
27.05.2026
SUSP_KERNEL_MODULE_KEYLOGGER_May26
Detects a kernel module that logs keyboard input. The module is likely to be used for keylogging purposes.
26.05.2026
SUSP_Crypto_Stealer_May26
Detects crypto stealer targeting secrets such as AWS, GitHub and OpenAI. It may detect legitimate secret scanner tools.
26.05.2026
MAL_GraphWorm_Backdoor_May26
Detects GraphWorm, a custom backdoor used by Webworm APT group that uses Microsoft Graph API for C2 communication
25.05.2026
MAL_APT_WebWorm_Implants_May26
Detects WebWorm APT implants, including custom proxy tools and backdoors used by the group.
25.05.2026
MAL_Custom_Uploader_May26
Detects a custom uploader used for data exfiltration
25.05.2026
HKTL_Python_Server_Exfiltration_May26
Detects a server-side Python script which serves as the receiver of exfiltrated data
25.05.2026
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest YARA Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_MSIL_NET_ConfuserEx_Module_Encryption_Sep23
12
c317faa484c3095deab765429326b8508f150c3c82d31bbaf049fa888795f178
SUSP_Credential_Stealer_Api_Indicators_Aug24
1
97297bb873894c7306ce797c9d6f4c9d34f36e6fcc00fdccb169c98e8947e0b5
SUSP_Protector_Themida_Packed_Samples_Mar21_1
8
f370925bb6b1ccfe6d79bc5f56d23f25e31eafc5244d3ab8c541f18ad53325c3
SUSP_Encoded_GetCurrentThreadId_FileOnly
1
d108b91f752fad77dbad7e7767c3173ab2040520ae763bee9074b9fd039d4abf
SUSP_Base64_Encoded_GetEnvironmentVariable
1
d108b91f752fad77dbad7e7767c3173ab2040520ae763bee9074b9fd039d4abf
SUSP_Encoded_GetCurrentThreadId_Ext1_Aug20
1
d108b91f752fad77dbad7e7767c3173ab2040520ae763bee9074b9fd039d4abf
SUSP_Encoded_GetProcAddress_Mar19
1
d108b91f752fad77dbad7e7767c3173ab2040520ae763bee9074b9fd039d4abf
SUSP_OBFUSC_Base64_Hex_Encoded_Apr19
7
b91b1d37b2581eec5c7358575e410e5374620f8c117dea6318175bb004480953
SUSP_Disable_WindowsDefender_Sep20_1
11
c2cf0bbff40addeda7ece61894b7ec19cc06e8fd8934c00054e79c5afd4a0352
SUSP_Defender_Disable_AV_Scanning
11
c2cf0bbff40addeda7ece61894b7ec19cc06e8fd8934c00054e79c5afd4a0352
Payload_Analysis_Aug17_Meterpreter
1
e129c9925a2ea772c5a1cb63136dc86764d7abcdfb8c51df65d8099a5c92a633
SUSP_Go_Binary_Function_Name_Oct24
1
548138fda53a77e83a5fa89c0444462ee51b7412b607e8fd852549433a87d678
Payload_Analysis_Aug17_Meterpreter
1
7e6d0d07a9721dfa7b47f44dacfa32efa7ce6bd600a71d0b9645336894033cc0
SUSP_UAC_Bypass_Indicators_Aug22_1
13
0bc7b80321f808b039d750c467f9545022c73c1d82b63363c279f0c590b33d34
YARA Rules Per Category
This list shows the number of YARA rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
7682
Threat Hunting (not subscribable, only in THOR scanner)
5919
APT
5067
Hacktools
4870
Webshells
2402
Exploits
738
Newest Sigma Rules
This table shows the newest additions to the Sigma rule set
Rule
Description
Date
Ref
Info
Bun JavaScript Runtime Executed Via Shell Spawned By Node.js On macOS
Detects a macOS shell process (e.g. zsh, bash, sh) spawned by Node.js with a command line referencing the Bun runtime, indicating a Node.js -> Shell -> Bun execution chain.
This pattern is commonly observed in supply chain attacks where a malicious npm package abuses Node.js to launch a shell that invokes Bun as a second-stage JavaScript or TypeScript payload runner.
Bun is attractive to attackers due to its native TypeScript support, fast startup, and broad system APIs, while being less scrutinized by EDR/AV solutions compared to Node.js itself.
26.05.2026
Bun JavaScript Runtime Executed Via Shell Spawned By Node.js On Linux
Detects a Linux shell process (e.g. bash, sh, dash) spawned by Node.js with a command line referencing the Bun runtime, indicating a Node.js -> Shell -> Bun execution chain.
This pattern is commonly observed in supply chain attacks where a malicious npm package abuses Node.js to launch a shell that invokes Bun as a second-stage JavaScript or TypeScript payload runner.
Bun is attractive to attackers due to its native TypeScript support, fast startup, and broad system APIs, while being less scrutinized by EDR/AV solutions compared to Node.js itself.
21.05.2026
Bun Runtime Execution Via Node.js Spawned Shell On Windows
Detects a Windows shell process (e.g. cmd.exe, powershell.exe) spawned by Node.js with a command line referencing the Bun runtime, indicating a Node.js -> Shell -> Bun execution chain.
This pattern is commonly observed in supply chain attacks where a malicious npm package abuses Node.js child_process APIs to launch a shell that invokes Bun as a second-stage JavaScript or TypeScript payload runner.
Bun is attractive to attackers due to its native TypeScript support, fast startup, and broad system APIs, while being less scrutinized by EDR/AV solutions compared to Node.js itself.
21.05.2026
Self-Referential Payload Extraction via PowerShell
Detects PowerShell scripts that read file content, extract an embedded payload via regex matching, and write the result to disk for further execution.
This self-referential technique allows an attacker to embed a full implant within a single carrier file and extract it at runtime, avoiding external network-based downloads entirely.
The payload is typically delimited by sentinel markers (e.g. #PYTHON_START / #PYTHON_END) and dropped to a persistent location.
12.05.2026
Self-Referential Payload Extraction via PowerShell Command Line
Detects PowerShell one-liners that read a file content, extract an embedded payload via regex matching, and write the result to disk for further execution.
This self-referential technique allows an attacker to embed a full implant within a single carrier file and extract it at runtime, avoiding external network-based downloads entirely.
The payload is typically delimited by sentinel markers (e.g. #PYTHON_START / #PYTHON_END) and dropped to a persistent location.
12.05.2026
PowerShell Dynamic Module Command Invocation via Index Access - PsScript
Detects PowerShell scripts that dynamically invoke commands from the Microsoft.PowerShell.Utility module using index access on the ExportedCommands collection.
Threat actors may use this technique to bypass detection mechanisms that look for specific command names, as the actual commands being invoked are determined at runtime and may not be explicitly mentioned in the script.
11.05.2026
PowerShell Dynamic Module Command Invocation via Index Access
Detects PowerShell scripts that dynamically invoke commands from the Microsoft.PowerShell.Utility module using index access on the ExportedCommands collection.
Threat actors may use this technique to bypass detection mechanisms that look for specific command names, as the actual commands being invoked are determined at runtime and may not be explicitly mentioned in the script.
11.05.2026
HH.EXE CHM File Decompilation
Detects execution of hh.exe with the -decompile (-d) flag to extract contents of a CHM file.
Threat actors abuse this technique to drop and execute malicious payloads embedded in CHM files.
08.05.2026
HH.EXE CHM Decompilation With Non-CHM File Extension
Detects execution of hh.exe with the -decompile (-d) flag where no .chm extension is present in the command line.
Threat actors disguise CHM files with alternative extensions (e.g. .doc, .pdf)
to evade detection, then pass them to hh.exe for decompilation and payload extraction.
08.05.2026
Net User Logon Time Restriction and Account Lockout
Detects usage of net user command to set logon time restrictions and disable accounts, a technique used by wipers to prevent user logins and lock out accounts, hindering recovery efforts.
04.05.2026
Network Interface Disabled Via Netsh
Detects netsh being used to disable a network interface.
Threat actors abuse this to cut off network connectivity and prevent remote recovery or intervention during destructive attacks.
04.05.2026
Winlogon CachedLogonsCount Registry Manipulation Via CLI
Detects command-line manipulation of the CachedLogonsCount registry value under the Winlogon key through commandline.
This value controls how many domain credential sets Windows caches locally.
Setting it to zero disables caching entirely, forcing direct domain controller authentication.
Threat actors may abuse this to prevent offline authentication or to hinder forensic credential recovery post-compromise.
04.05.2026
Diskpart Volume Clean All Execution
Detects the execution of diskpart's "clean all" command, which permanently destroys all data on
a disk volume by overwriting every sector with zeros. Threat actors abuse this for data destruction
and wiper attacks.
04.05.2026
Robocopy Mirror Directory Wipe
Detects robocopy invoked with /MIR and /B flags, a technique commonly abused by wipers to
overwrite entire directory trees by mirroring an empty source folder in backup mode,
permanently destroying all file contents.
04.05.2026
Winlogon CachedLogonsCount Registry Value Set To Zero
Detects registry set events where the CachedLogonsCount value under the Winlogon key is set to zero.
This disables Windows cached domain credentials, forcing direct domain controller authentication.
Threat actors may abuse this to prevent offline authentication or to hinder forensic credential recovery post-compromise.
04.05.2026
Large File Creation Via Fsutil
Detects fsutil being used to create a new file with a suspiciously large size.
Threat actors abuse this technique to fill all available disk space, exhausting the filesystem
and preventing the OS from writing logs, recovery artifacts, or any new data.
04.05.2026
Free Disk Space Enumeration Via Fsutil
Detects the use of fsutil to enumerate free disk space on a volume.
Threat actors may abuse this to determine available space before carrying out further actions such as data destruction or exfiltration.
04.05.2026
Kubernetes Potential Enumeration Activity
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
28.04.2026
Google Workspace Out Of Domain Email Forwarding
Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
28.04.2026
Suspicious Login Activity Classified By Google
Detects Google Workspace login activity that's classified as suspicious by Google.
28.04.2026
Google Workspace Government Attack Warning
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
28.04.2026
Cisco Dot1x Disabled
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
28.04.2026
Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
28.04.2026
Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI
Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:).
An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource.
When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash.
HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access.
The URI can be delivered via a malicious hyperlink, phishing email, or web page.
28.04.2026
Sensitive File Dump Via Print.EXE
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
28.04.2026
PUA - Memory Dump Mount Via MemProcFS
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
27.04.2026
Service Startup Type Change Via Wmic.EXE
Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
27.04.2026
Suspicious Task Scheduler XML Pattern Related with AtExec
Detects creation of scheduled tasks with XML patterns commonly associated with Atexec,
a component of the NetExec tool that allows execution of commands via scheduled tasks for persistence and privilege escalation.
27.04.2026
Suspicious Certificate Request Pattern via CertReq
Detects suspicious certificate request patterns that may indicate abuse of certreq.exe for privilege escalation or lateral movement.
27.04.2026
YARA/SIGMA Rule Count
Rule Type
Community Feed
Nextron Private Feed
Yara
2822
21356
Sigma
3589
1018
Sigma Rules Per Category (Community)
Type
Count
windows / process_creation
1350
windows / registry_set
219
windows / file_event
209
windows / ps_script
166
windows / security
160
linux / process_creation
139
windows / image_load
114
webserver
82
windows / system
74
macos / process_creation
69
aws / cloudtrail
55
proxy
54
linux / auditd
53
windows / network_connection
53
azure / activitylogs
42
windows / registry_event
40
azure / auditlogs
38
windows / ps_module
33
windows / application
31
windows / dns_query
27
windows / process_access
25
azure / signinlogs
24
opencanary / application
24
okta / okta
22
azure / riskdetection
19
windows / pipe_created
19
windows / windefend
17
rpc_firewall / application
17
linux
16
gcp / gcp.audit
16
github / audit
15
linux / file_event
15
bitbucket / audit
14
cisco / aaa
13
windows / file_delete
13
m365 / threat_management
13
windows / create_remote_thread
12
dns
10
windows / driver_load
10
kubernetes / application / audit
10
windows / registry_delete
10
windows / codeintegrity-operational
10
windows / ps_classic_start
9
windows / appxdeployment-server
9
windows / create_stream_hash
9
windows / firewall-as
8
windows / msexchange-management
8
antivirus
7
fortigate / event
7
azure / pim
7
windows / file_access
7
windows / bits-client
7
gcp / google_workspace.admin
7
zeek / smb_files
7
kubernetes / audit
6
windows / dns-client
6
jvm / application
5
zeek / dns
5
linux / network_connection
5
zeek / http
5
windows / taskscheduler
4
windows / iis-configuration
4
zeek / dce_rpc
4
m365 / audit
4
macos / file_event
4
windows / sysmon
4
windows / wmi_event
3
windows / powershell-classic
3
windows / ntlm
3
windows / registry_add
3
gcp / google_workspace.login
3
linux / sshd
3
onelogin / onelogin.events
2
firewall
2
linux / syslog
2
windows / security-mitigations
2
spring / application
2
windows / dns-server
2
apache
2
velocity / application
1
cisco / duo
1
nginx
1
linux / sudo
1
cisco / ldp
1
windows / ldap
1
windows / wmi
1
windows / dns-server-analytic
1
database
1
cisco / bgp
1
windows / ps_classic_provider_start
1
windows / printservice-operational
1
windows / printservice-admin
1
linux / clamav
1
windows / lsa-server
1
django / application
1
linux / auth
1
windows / appmodel-runtime
1
fortios / sslvpnd
1
linux / guacamole
1
windows / applocker
1
windows / openssh
1
cisco / syslog
1
linux / cron
1
juniper / bgp
1
windows / appxpackaging-om
1
windows / process_tampering
1
windows / smbclient-connectivity
1
huawei / bgp
1
windows / smbserver-connectivity
1
nodejs / application
1
paloalto / file_event / globalprotect
1
linux / vsftpd
1
zeek / x509
1
windows / capi2
1
windows / microsoft-servicebus-client
1
windows / file_change
1
windows / raw_access_thread
1
paloalto / appliance / globalprotect
1
windows / certificateservicesclient-lifecycle-system
1
python / application
1
windows / shell-core
1
windows / diagnosis-scripted
1
windows / smbclient-security
1
windows / file_executable_detected
1
m365 / exchange
1
zeek / rdp
1
windows / file_rename
1
windows / sysmon_status
1
ruby_on_rails / application
1
zeek / kerberos
1
windows / terminalservices-localsessionmanager
1
windows / sysmon_error
1
sql / application
1
m365 / threat_detection
1
windows / driver-framework
1
windows
1
Sigma Rules Per Category (Nextron Private Feed)
Type
Count
windows / process_creation
503
windows / registry_set
90
windows / ps_script
87
linux / process_creation
53
windows / file_event
47
windows / image_load
46
windows / security
29
windows / wmi
29
proxy
13
windows / system
13
windows / network_connection
9
windows / registry_event
8
windows / kernel-event-tracing
6
windows / ntfs
5
windows / ps_module
5
windows / dns_query
5
windows / sense
4
windows / pipe_created
4
webserver
4
windows / taskscheduler
4
windows / create_remote_thread
4
windows / registry_delete
4
windows / hyper-v-worker
3
macos / process_creation
3
windows / ps_classic_script
3
dns
3
windows / vhd
3
windows / application-experience
3
windows / driver_load
3
windows / kernel-shimengine
2
windows / file_access
2
windows / file_delete
2
linux / file_event
2
windows / smbclient-security
2
windows / process_access
2
windows / windefend
2
windows / bits-client
2
windows / codeintegrity-operational
2
windows / file_rename
1
linux / file_delete
1
windows / firewall-as
1
windows / application
1
windows / audit-cve
1
windows / amsi
1
windows / registry-setinformation
1
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR