currently serving 14859 YARA rules
New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
SUPS_PS1_Tiny_Loader_Characteristics_Jan22
Detects indicators often found in suspicious small PowerShell downloaders
21.01.2022
SUPS_PS1_Backdoor_Jan22_1
Detects indicators found in suspicious small PowerShell backdoor
21.01.2022
SUPS_PS1_AES_Managed_Jan22_1
Detects suspicious use of System.Security.Cryptography.AesManaged in PowerShell scripts
21.01.2022
SUPS_PS1_Encryption_Jan22_2
Detects suspicious indicators found in malicious scripts that use encryption
21.01.2022
SUSP_OBFUSC_Base64_String_Split_Jan22
Detects split base64 string often found in obfuscated scripts
21.01.2022
WEBSHELL_PHP_Wordpress_Backdoors_Jan22_1
Detects PHP webshell implants used in Wordpress supply chain attacks
21.01.2022
LOG_CodeIntegrity_Blocked_Driver_Load
Detects events in the CodeIntegrity event log that indicate driver loads that were blocked due to unmet signing level requirements
20.01.2022
WEBSHELL_EXPL_VMWare_Horizon_JS_Shells_Jan22_1
Detects VMWare Horizon JS shells planted after successful Log4Shell exploitation
20.01.2022
SUSP_IAppIdPolicyHandler_GUID_EXE_Jan22
Detects suspicious IAppIdPolicyHandler GUID in executable files
19.01.2022
SUSP_PS1_OBFUSC_Jan22_1
Detects suspicious PowerShell obfuscation noticed in malicious scripts
19.01.2022
SUSP_VBS_OBFUSC_Jan22_1
Detects suspicious PowerShell obfuscation noticed in malicious scripts
19.01.2022
SUSP_VBS_WScript_IPC_Combo_Jan22_2
Detects suspicious VBS scripts that comine WScript.Shell directives with the IPC$ keyword
19.01.2022
SUSP_PS1_OBFUSC_Base64String_Jan22_1
Detects suspicious split up and obfuscated Base64String value
19.01.2022
SUSP_Bitsadmin_Pattern_Jan22_1
Detects suspicious bitsadmin pattern often found in malicious dropper scripts
19.01.2022
SUPS_HKTL_WinPEAS_Output_Jan22
Detects output generated by WinPEAS which is a tool that searchs for possible paths to escalate privileges on Windows hosts
19.01.2022
HKTL_WinPEAS_Jan22
Detects WinPEAS which is a script that searchs for possible paths to escalate privileges on Windows hosts
19.01.2022
HKTL_LinPEAS_Jan22
Detects LinPEAS which is a tool that searchs for possible paths to escalate privileges on Linux/MacOS hosts
19.01.2022
MAL_RANSOM_Wiper_Jan22_1
Detects Ransomware or Wiper malware related to campaign against Ukrainian targets
19.01.2022
MAL_Unknown_Loader_Jan22_1
Detects suspicious samples that contain indicators as found in ransomware samples noticed in January 2022
19.01.2022
APT_WEBSHELL_PHP_Prometheus_Jan22_1
Detects suspicious samples that contain indicators as found in ransomware samples noticed in January 2022
19.01.2022
APT_CampoLoader_Jan22_1
Detects suspicious samples that contain indicators as found in ransomware samples noticed in January 2022
19.01.2022
SUSP_HKTL_SharpAppLocker_JSON_Output_Jan22
Detects output files of SharpAppLocker which is a C# port of the Get-AppLockerPolicy PS cmdlet with extended features
18.01.2022
HKTL_SHARPFILES_Jan22
Detects Sharpfiles which is a tool to search for files based on SharpShares
18.01.2022
HKTL_SHARPLAPS_Jan22
Detects SharpLAPS which is a tool to retrieve LAPS passwords from LDAP
18.01.2022
HKTL_WMIREG_Jan22
Detects WMIReg which is a tool used to read and write to local and remote registry keys
18.01.2022
HKTL_SEARCH_OUTLOOK_Jan22
Detects SearchOutlook which is a tool used to search through a running instance of Outlook for keywords
18.01.2022
HKTL_SharpAppLocker_Jan22
Detects SharpAppLocker which is a C# port of the Get-AppLockerPolicy PS cmdlet with extended features
18.01.2022
APT_HKTL_FRP_ME_Indicators_Jan22_1
Detects indicators found in Go based samples used by Charming Kitten
18.01.2022
APT_ME_Artefacts_Jan22_1
Detects artefacts found in Charming Kitten intrusions
18.01.2022
SUSP_PS1_CReplace_Casing_Anomaly
Detects suspicious casing in -creplace command used in PowerShell scripts
17.01.2022
SUSP_PS1_PowerShell_Uncommon_Flags_Jan22_1
Detects an uncommon PowerShell flag combination often found in malicious samples
17.01.2022
SUSP_PUA_CommandPatterns_Jan22_1
Detects command patterns found in bash_history of compromised systems
17.01.2022
SUSP_HKTL_CommandPatterns_Jan22_1
Detects command patterns found in bash_history of compromised systems
17.01.2022
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
Info
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_PowerShell_Agent_Characteristics_Jun21_1
12
3e72d82987b88609b5ede57d334865973225ada3cf0351f8d1a3683a1a806adb
SUSP_UPX_Compressed_Go_Binary_Dec21_1
12
7960721ebc18c60510ebcc6dfd27766560174588952d67f1699175bf89a9337c
SUSP_PE_Discord_Attachment_Oct21_1
8
1101244026b613dcc52185943c02f51727784bd7631c4da7d3cdf2ee0ce9e896
SUSP_PUA_ScreenConnect_Client_Setup_Oct21_1
7
048127e1f8dcaa183bb9895208d283692d38dd5a1fc0400adee639de8b9f810b
Rules Per Category
This list shows the number of rules in the subscribable categories (categories overlap as a rule can be in 'n' categories)
Tag
Count
Malware
4601
APT
4022
Hacktools
3478
Threat Hunting
2907
Webshells
2097
Exploits
402
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls
Carbon Black
Tutorial: https://github.com/carbonblack/cb-yara-connectorFireEye EX
Tutorial: https://www.fireeye.com/blog/products-and-services/2018/12/detect-and-block-email-threats-with-custom-yara-rules.html
Scan your endpoints, forensic images or collected files with our portable scanner THOR