Rule Info
Name
PUA_NORMA_Usage_Oct26
Author
X__Junior
Description
Detects use of Norma, an engine that turns a language model into an autonomous agent. It runs a streaming tool-use loop that lets the model read, execute, and reason its way through a task, while the operator retains control over the prompt, the available tools, and the safety boundary. Norma is not malicious on its own.
Score
60
Reference
Date
2026-10-28
Minimum Yara
3.5.0
Rule Hash
d8e18073b68b4601f4ba2d144b993a01
Tags
['EXE', 'FILE']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
2
Clean (0 engines)
15
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR