New YARA Rules per Day
Newest YARA Rules
This table shows the newest additions to the rule set
Rule
Description
Date
Ref
WEBSHELL_PHP_ME_Jan20_1
Detects Webshell used in Middle Eastern campaigns
22.01.2020
MAL_AVKiller_Jan20_1
Detects a malware sample referenced as AVKiller
22.01.2020
HKTL_PUA_Secure_Socket_Funneling
Detects Secure Socket Funneling - Network tool and toolkit
22.01.2020
>
HKTL_PUA_Secure_Socket_Funneling_UPX
Detects MuddyWater samples - from files upx-ssf, upx-ssf.exe
22.01.2020
>
APT_MuddWater_Helper_Jan20_1
Detects MuddyWater samples
22.01.2020
APT_CN_Tick_Group_MZ_Header_Mod_Jan20_1
Detects MZ modification as applied by Chinese Tick threat actor
22.01.2020
>
APT_CN_Tick_Group_ABK_Downloader_Jan20_1
Detects malware used by Chinese Tick threat actor
22.01.2020
>
APT_CN_Tick_Group_Avirra_Downloader_Jan20_1
Detects malware used by Chinese Tick threat actor
22.01.2020
>
SUSP_MalDoc_Indicators_Jan20_1
Detects samples that look the weaponized Office documents
21.01.2020
>
APT_RoyalRoad_8_T_Header_Pattern
Detects file with RoyalRoad encrypted payload magic header found in 8.t files
21.01.2020
>
WEBSHELL_JSP_MuddyWater_Jan20_1
Detects samples noticed in MuddyWater campaign
20.01.2020
SUSP_CMD_Obfuscation_Jan20
Detects suspicious technique to obfuscation cmd.exe
20.01.2020
SUSP_Obfusc_JS_MuddyWater_Jan20_1
Detects obfuscation used by MuddyWater in a campaign
20.01.2020
APT_MAL_Helper_PS1_MuddyWater_Jan20_1
Detects samples noticed in MuddyWater campaign
20.01.2020
APT_MAL_Helper_PS1_MuddyWater_Jan20_2
Detects samples noticed in MuddyWater campaign
20.01.2020
SUSP_JS_Obfusc_JSFuck_Jan20_1
Detects Javascript obfuscation technique JSFuck using a set of special characters
18.01.2020
>
MAL_Unknown_Camp_DE_Jan20_2
Detects malware dropped in campaign noticed in January 2020
17.01.2020
>
MAL_JhoneRAT_JPEG_Embedded_EXE_Jan20_1
Detects malware and dropped components of JhoneRAT
17.01.2020
>
SUSP_Payload_Indicator_OleObject_Jan20_1
Detects suspicious code sequence found in many different malicious dropper documents with embedded payloads
17.01.2020
>
Successful YARA Rules in Set
This table shows statistics of the best rules with lowest AV detection rates (rules created in the last 12 months, matches of the last 14 days)
Rule
Average AV Detection Rate
Sample Count
VT
Latest Matches with Low AV Detection Rate
This table lists the last matches with low AV detection rates (between 0 and 15 AV engines matched)
Rule
AVs
Hash
VT
SUSP_AutoIt_CompScript_NET_Combo
5
f8bf4400d8c5966482a27c5c533864aba38f68f1186d4ef39532fa2901397679
>
SUSP_AutoIt_Malware_Indicator_1
5
f8bf4400d8c5966482a27c5c533864aba38f68f1186d4ef39532fa2901397679
>
SUSP_ELF_LNX_UPX_Compressed_File
14
6852f45f36651f3fd0f332d49a7005203200ef0c74b7c5066d946b589d073f55
>
SUSP_ELF_LNX_UPX_Compressed_File
14
c90753bcdc6c23cc06ca6dc304d60f112532824361990087dac527a8ea5a4425
>
SUSP_OfficeDoc_DropperStrings_Dec18_1
3
bcc02c8470d23b0b9cd663e05ff098c9db88b4baad4812222301f71e777abf51
>
SUSP_OfficeDic_Macro_Strings_Gen_Jan19_1
3
bcc02c8470d23b0b9cd663e05ff098c9db88b4baad4812222301f71e777abf51
>
SUSP_OfficeDoc_Macro_Indicator_Jun19_1
3
bcc02c8470d23b0b9cd663e05ff098c9db88b4baad4812222301f71e777abf51
>
SUSP_OfficeDoc_Macro_Indicator_SubAutoOpen_Jun19_2
1
0dc075215a29249772e9b91b0d1968511c5802caf7e9b0ef0741c554dd51aa83
>
SUSP_OfficeDoc_Macro_Indicator_Jun19_1
1
0dc075215a29249772e9b91b0d1968511c5802caf7e9b0ef0741c554dd51aa83
>
SUSP_Compromised_Cert_LuckyMouse
1
392c45f93294217720b59a5eee24970bc161077bbc3dab0255e3b6462e249e24
>
SUSP_Double_Base64_Encoded_Executable
12
13e7554a2a433e909ede37c487f56ef496c36a30cfc4cec2441ebb17e5f33d22
>
SUSP_ConfuserEx_Obfuscated_Gen
13
af53e14185aa56858d4635fcefa117c84b54a8b23723fd7ce38314720570037a
>
Top Tags in YARA Rule Set
This list shows the top tags used in our database, which are used for the subscribable categories
Tag
Count
FILE
6504
EXE
4667
APT
2788
MAL
2735
HKTL
2493
DEMO
2446
T1100
1839
WEBSHELL
1811
SUSP
1326
CHINA
1025
SCRIPT
663
RUSSIA
408
T1086
364
MIDDLE_EAST
350
T1027
323
T1064
313
GEN
307
T1003
272
T1193
253
T1203
253
T1075
205
OBFUS
165
T1132
162
EXPLOIT
161
T1085
154
LINUX
146
T1178
134
T1097
134
METASPLOIT
112
T1053
111
Tenable Nessus
Requirement: Privileged Scan
- YARA Scanning with Nessus works only when scanning with credentials (privileged scan)
YARA Scanning with Nessus
- You can only upload a single .yar file
- Filesystem scan has to be activated
- You have to define the target locations
- The Nessus plugin ID will be 91990
- Only files with the following extensions can be scanned: .application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cp, .csh, .dl, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .js, .jse, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xm, .ps2, .ps2xm, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vb, .vbe, .vbs, .vbscript, .ws, .wsf, .xls, .xls