New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUSP_Encoded_Casing_Modified_CMD
Detects encoded cmde.exe strings with uncommon casing
02.07.2020
SUSP_GIF_Anomalies
Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type
02.07.2020
>
APT_MAL_Unknown_Agent_AUS_Campaign_Jul20_1
Detects samples allegedly related to AUS parliament hack
02.07.2020
>
APT_MAL_PowerKatz_AUS_Campaign_Jul20_1
Detects samples allegedly related to AUS parliament hack
02.07.2020
>
SUSP_OBFUSC_PowerShell_Jul20_1
Detects indicators of obfuscation used in malicious PowerShell scripts
01.07.2020
>
SUSP_Explorer_Root_Defense_Evasion_Jun20_1
Detects explorer.exe command line method sometimes used to evade detection by breaking the typical process tree
29.06.2020
>
SUSP_Packer_Indicator_Jun20_1
Detects a suspicious packer indicator noticed in June 2020
29.06.2020
HKTL_MSHTA_VBS_Downloader_Jun20_1
Detects hacktool that uses MSHTA and VBS to download files
29.06.2020
>
HKTL_Shellcode_Encoded_Jun20_1
Detects shellcode in encoded form - often used in hacktools
29.06.2020
>
APT_MAL_BAT_InvisiMole_Artifacts_Jun20_4
Detects batch helper file mentioned in InvisiMole report
29.06.2020
>
APT_CN_BRONZE_VINEWOOD_Artefacts_Jun20_1
Detects WinApicExec artifacts mentioned in InvisiMole report (page 16)
29.06.2020
>
APT_MAL_CN_BRONZE_VINEWOOD_PS1_Malware_Jun20_1
Detects BRONZE VINEWOOD PowerShell script
29.06.2020
>
APT_MAL_CN_BRONZE_VINEWOOD_HanaLoader_Malware_Jun20_1
Detects BRONZE VINEWOOD Hana Loader malware
29.06.2020
>
APT_MAL_CN_BRONZE_VINEWOOD_DropboxAES_RAT_Jun20_1
Detects BRONZE VINEWOOD DropboxAES RAT malware
29.06.2020
>
APT_CN_BRONZE_VINEWOOD_DropboxAES_RAT_BAT_Helper_Jun20_1
Detects BRONZE VINEWOOD DropboxAES helper file
29.06.2020
>
GetChildItem_Keyword_Casing_Anomaly
Detects obfuscated GetChildItem by casing anomalies
27.06.2020
>
SUSP_OBFUSC_PowerShell_Indicator_Jun20_1
Detects indicators often found in obfuscated PowerShell scripts
27.06.2020
>
SUSP_OBFUSC_PowerShell_True_Jun20_1
Detects indicators often found in obfuscated PowerShell scripts
27.06.2020
>
SUSP_OBFUSC_PS1_Bypass_Jun20_1
Detects PowerShell scripts that show signs of obfuscation
27.06.2020
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_Administrator_Desktop_Reference
11
1db03bb904f87ee598b8f59dea39f9f6d94b2d8eb8a30a2fefd202958cb1515e
>
SUSP_Administrator_Desktop_Reference
12
c8cef19967cb820d5e92f85a17ebf98f631de62c9760b1eb1a790cb25961e356
>
SUSP_Administrator_Desktop_Reference
6
2485826ad6e01c5ae26b460a9152854b3a6780da46f4abbca35be5b0bd570eb3
>
SUSP_Administrator_Desktop_Reference
10
553ee875b3fc39e67daff6b7ace6590da149818f31bc7f84bc115858d10ab4f9
>
SUSP_Administrator_Desktop_Reference
1
3892ed500e6a4308b4f2bafa37ea69233ae249a832bc5a96369d18b6adea5539
>
PEFILE_Header_but_no_DOS_Header
1
2bef8fab4a998bb3ad7375cd3d17bd71a9d68d46d0f99362923b15f87a940a45
>
MAL_MetaSploit_Android_Stage_Jul19
14
938afd1c9b55b67bbeb6efa9657ae18a5e3b970cfe025941a6812e1c9e9b76f4
>
SUSP_Administrator_Desktop_Reference
13
635411fb8a81c1232977130d52f6643995799475f35d4d3ecf2c0b74c307c876
>
Top Tags in YARA Rule Set
This list shows the top tags used in our database, which are used for the subscribable categories
Tag
Count
T1136
10116
FILE
7201
EXE
5161
APT
3128
MAL
3007
HKTL
2730
DEMO
2474
T1100
1932
WEBSHELL
1901
SUSP
1555
CHINA
1099
SCRIPT
744
T1086
446
RUSSIA
422
T1027
383
MIDDLE_EAST
372
T1064
313
GEN
313
T1003
293
T1193
273
T1203
273
T1075
237
G0044
216
OBFUS
212
T1132
195
EXPLOIT
185
G0007
176
LINUX
175
T1085
163
T1097
147
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls