currently serving 11612 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
APT_MalDoc_NK_HiddenCobra_Indicators_Nov20_1
Detects files with Hidden Cobra indicators
11.11.2020
SUSP_Tiny_PowerShell_Execution_File
Detects a suspiciously small file with a powershell invocation
11.11.2020
SUSP_MalDoc_Indicator_VBA_Nov20_1
Detects a suspicious indicator found in malicious VBA scripts
11.11.2020
SUSP_Protonmail_in_Executable
Detects suspicious protonmail.ch address in executable
11.11.2020
APT_MAL_RU_TA505_Nov20_1
Detects TA505 malware samples
10.11.2020
MAL_Gen_Unknown_Nov20_1
Detects unknown malware samples
10.11.2020
MAL_Gen_Unknown_Nov20_2
Detects unknown malware samples
10.11.2020
APT_MAL_VN_OceanLotus_RAR_Nov20_1
Detects files with similarity to RAR archives used by Ocean Lotus to ship malicious files
09.11.2020
APT_SUSP_ME_Encoded_Whoami_XHunt_Nov20_1
Detects encrypted string as mentioned in xHunt report
09.11.2020
SUSP_Base64_Encoded_WhomAmI
Detects suspicious encoded whoami string that is a program to evaluate the current user name and often used in malcious or benign recon scripts
09.11.2020
SUSP_Base64_Encoded_WhomAmI_Wide
Detects suspicious encoded whoami string that is a program to evaluate the current user name and often used in malcious recon scripts
09.11.2020
SUSP_Base64_Encoded_WebLogic_Decoder
Detects suspicious base64 encoded WebLogic Base64Decode as often found in malicious code
09.11.2020
MAL_LNX_SSHD_Backdoor_Nov20_1
Detects a Linux SSH backdoor
06.11.2020
SUSP_MalDoc_Macro_Indicators_Nov20_1
Detects indicators of malicious Macros in Office documents
06.11.2020
SUSP_Double_Base64_Encoded_MSDOS_Stub_Nov20
Detects double base64 encoded MSDOS Stub in file
06.11.2020
SUSP_Triple_Base64_Encoded_MSDOS_Stub_Nov20
Detects triple base64 encoded MSDOS Stub in file
06.11.2020
MAL_MalDoc_CS_Loader_Nov20_1
Detects malicious documents found in a campaign with CobaltStrike payloads
05.11.2020
APT_UNC1945_ForensicArtefacts_Nov20_1
Detects forensic artefacts as reported in UNC1945 report
03.11.2020
APT_MalDoc_Donot_Note_Nov20_1
Detects phishing doc note used by Donot APT malicious office droppers
03.11.2020
EXPL_CVE_2017_11882_Nov20
Detects suspicious RTF documents with indicators found in documents that exploit CVE-2017-11882
03.11.2020
SUSP_MalDoc_JS_Indicators_Nov20_1
Detects suspicious document with
03.11.2020
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_OfficeDoc_Macro_Indicator_SubAutoOpen_Jun19_2
2
cda2706e22fe242be9f169f0759384f107af6e43473685c7b867c4fe20dd0355
APT_CN_JSP_Shack2_Webshell_Apr20_1
7
d0ad85e652e2c6091af6f347aef9e918c954580609f715e376226edd12b5bc15
HKTL_JS_OBFUSC_Loader_Indicators_Oct20_1
3
0e5219747dd28946fd178a6b18c3d872c041d2334c81f0039b3b62645d2d4f8b
SUSP_MZ_DefaultStub_in_Encoded_Form
1
6cfa952d18bdf6bedf272ddace8d75a16965d9e4b8c8e5a1691ae593111a9a16
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
APT
3386
Malware
3177
Hacktools
2972
Webshells
1944
Threat Hunting
1719
Exploits
219
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR