| .. |
|
apt_alienspy_rat.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_apt6_malware.yar
|
Mirai Botnet Malware and Improvements
|
2016-10-06 08:48:52 +02:00 |
|
apt_apt17_malware.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_apt28.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_apt29_grizzly_steppe.yar
|
Updated Grizzly Steppe
|
2017-01-02 08:10:21 +01:00 |
|
apt_apt30_backspace.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_backdoor_ssh_python.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_backspace.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_beepservice.yar
|
Signature Update
|
2016-05-13 06:06:18 -06:00 |
|
apt_between-hk-and-burma.yar
|
Adjusted SLServer Rule
|
2016-04-21 11:03:55 +02:00 |
|
apt_blackenergy_installer.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_blackenergy.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_bluetermite_emdivi.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_buckeye.yar
|
APT Buckeye
|
2016-09-10 01:16:28 +02:00 |
|
apt_casper.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_cheshirecat.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_cloudduke.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_codoso.yar
|
False Positives
|
2016-02-29 13:46:21 +01:00 |
|
apt_coreimpact_agent.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_cve2015_5119.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_danti_svcmondr.yar
|
Danti and SVCMONDR Malware Rules
|
2016-05-25 16:14:11 -06:00 |
|
apt_deeppanda.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_derusbi.yar
|
Mirai Botnet Malware and Improvements
|
2016-10-06 08:48:52 +02:00 |
|
apt_dubnium.yar
|
Dubnium YARA Signatures
|
2016-06-10 17:03:29 +02:00 |
|
apt_duqu2.yar
|
Bugfix in Duqu2 Rule
|
2016-07-02 19:35:33 +02:00 |
|
apt_emissary.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_eqgrp.yar
|
EquationGroup Rules Update
|
2017-01-14 19:38:43 +01:00 |
|
apt_fakem_backdoor.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_fancybear_dnc.yar
|
Fancy / Cozy Bear Sigs
|
2016-07-02 19:32:02 +02:00 |
|
apt_fidelis_phishing_plain_sight.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_four_element_sword.yar
|
Signature Updates
|
2016-04-20 09:26:09 +02:00 |
|
apt_furtim.yar
|
Furtims Parent
|
2016-07-17 12:59:29 +02:00 |
|
apt_fvey_shadowbroker_dec16.yar
|
ShadowBroker Screens / README Extractions
|
2016-12-18 11:41:35 +01:00 |
|
apt_fvey_shadowbroker_jan17.yar
|
ShadowBrokers Screens File Names Jan17
|
2017-01-10 11:07:04 +01:00 |
|
apt_ghostdragon_gh0st_rat.yar
|
Gh0st Dragon RAT
|
2016-04-27 13:36:53 +02:00 |
|
apt_glassRAT.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_hackingteam_rules.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_hellsing_kaspersky.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_hizor_rat.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_indetectables_rat.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_inocnation.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_irongate.yar
|
False Positive - PipeList
|
2016-12-27 23:20:01 +01:00 |
|
apt_irontiger_trendmicro.yar
|
False Positive Fixes
|
2016-04-26 10:04:19 +02:00 |
|
apt_irontiger.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_kaspersky_duqu2.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_keylogger_cn.yar
|
New Signatures
|
2016-03-09 13:40:49 +01:00 |
|
apt_korplug_fast.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_laudanum_webshells.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_miniasp.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_minidionis.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_mofang.yar
|
FoxIT Mofang IOCs and YARA Rules
|
2016-06-15 18:58:10 +02:00 |
|
apt_ms_platinum.yara
|
Microsoft Platinum YARA Rules
|
2016-04-27 13:36:39 +02:00 |
|
apt_naikon.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_nanocore_rat.yar
|
Nano core Rule
|
2016-04-25 10:26:46 +02:00 |
|
apt_oilrig.yar
|
OilRig Campaign
|
2016-10-13 09:40:36 +02:00 |
|
apt_onhat_proxy.yar
|
Signature Update
|
2016-05-13 06:06:18 -06:00 |
|
apt_op_cleaver.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_passcv.yar
|
PassCV YARA Rules
|
2016-10-21 11:44:38 +02:00 |
|
apt_passthehashtoolkit.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_plugx.yar
|
PlugX Signature by Jay DiMartino
|
2016-08-17 13:20:52 +02:00 |
|
apt_poisonivy_gen3.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_poisonivy.yar
|
Signature Update
|
2016-05-13 06:06:18 -06:00 |
|
apt_poseidon_group.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_prikormka.yar
|
Bugfix in prikormka Rules
|
2016-06-17 17:24:28 +02:00 |
|
apt_project_m.yar
|
Signature Update
|
2016-04-01 16:51:30 +02:00 |
|
apt_project_sauron_extras.yar
|
My Sauron Extra Rules
|
2016-08-10 09:34:15 +02:00 |
|
apt_project_sauron.yara
|
Project Sauron
|
2016-08-08 17:11:20 +02:00 |
|
apt_promethium_neodymium.yar
|
Promethium Neodymium YARA Rules
|
2016-12-27 23:23:46 +01:00 |
|
apt_putterpanda.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_quarkspwdump.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_rocketkitten_keylogger.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_ruag.yar
|
RUAG APT Case YARA Signatures
|
2016-05-24 07:29:20 -06:00 |
|
apt_rwmc_powershell_creddump.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_sakula.yar
|
Turla Rules - RUAG APT
|
2016-06-13 10:41:59 +02:00 |
|
apt_scanbox_deeppanda.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_seaduke_unit42.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_shamoon2.yar
|
Shamoon 2.0 Rev1
|
2016-12-01 23:02:21 +01:00 |
|
apt_shamoon.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_skeletonkey.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_snowglobe_babar.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_sofacy_dec15.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_sofacy_fysbis.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_sofacy_jun16.yar
|
Sofacy Samples June 2016
|
2016-06-15 06:54:30 +02:00 |
|
apt_sofacy_xtunnel_bundestag.yar
|
Signature Update
|
2016-05-13 06:06:18 -06:00 |
|
apt_sphinx_moth.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_strider.yara
|
Symantec Strider IOCs and YARA Rules
|
2016-08-10 09:33:54 +02:00 |
|
apt_stuxnet.yar
|
Stuxnet Rules
|
2016-07-11 19:48:03 +02:00 |
|
apt_suckfly.yar
|
Sickly Nidiran Trojan YARA Signatures
|
2016-06-09 09:37:59 +02:00 |
|
apt_sysscan.yar
|
SysScan Rules by Kaspersky
|
2016-07-02 19:32:36 +02:00 |
|
apt_telebots.yar
|
Telebots YARA Rule
|
2016-12-27 23:23:59 +01:00 |
|
apt_terracotta_liudoor.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_terracotta.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_threatgroup_3390.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_tidepool.yar
|
Danti and SVCMONDR Malware Rules
|
2016-05-25 16:14:11 -06:00 |
|
apt_turbo_campaign.yar
|
Derusbi ELF / Win32 Turbo Campaign
|
2016-02-29 20:32:42 +01:00 |
|
apt_turla.yar
|
Turla Rules - RUAG APT
|
2016-06-13 10:41:59 +02:00 |
|
apt_unit78020_malware.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_venom_linux_rootkit.yar
|
Venom Linux Rootkit
|
2017-01-14 19:38:06 +01:00 |
|
apt_volatile_cedar.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_waterbug.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_webshell_chinachopper.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_wildneutron.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_win_plugx.yar
|
Adjusted YARA Rule
|
2016-06-08 21:08:44 +02:00 |
|
apt_winnti.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
apt_woolengoldfish.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
cn_pentestset_scripts.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
cn_pentestset_tools.yar
|
False Positive with old mstsc
|
2016-03-23 10:05:57 +01:00 |
|
cn_pentestset_webshells.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_antifw_installrex.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_bernhard_pos.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_buzus_softpulse.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_cmstar.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_cryptowall_svg.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_dexter_trojan.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_dridex_xml.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_enfal.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_fareit.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_goldeneye.yar
|
GoldenEye Ransomware
|
2016-12-06 17:13:12 +01:00 |
|
crime_kins_dropper.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_kraken_bot1.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_locky.yar
|
Locky Ransomware
|
2016-02-17 18:03:58 +01:00 |
|
crime_malumpos.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_malware_generic.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_malware_set_oct16.yar
|
Signature Update October 2016 A
|
2016-10-09 11:33:29 +02:00 |
|
crime_mikey_trojan.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_mirai.yar
|
Mirai Botnet Malware and Improvements
|
2016-10-06 08:48:52 +02:00 |
|
crime_petya_ransom.yar
|
Minor Changes to YARA Rules
|
2016-06-08 11:28:42 +02:00 |
|
crime_phish_gina_dec15.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_rombertik_carbongrabber.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_shifu_trojan.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
crime_upatre_oct15.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
exploit_cve_2015_1674.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
exploit_cve_2015_1701.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
exploit_cve_2015_2426.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
exploit_uac_elevators.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_ace_with_exe.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_b374k_extra.yar
|
OTX Update and b374k back connect shell
|
2016-08-26 21:43:11 +02:00 |
|
gen_cn_hacktool_scripts.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_cn_hacktools.yar
|
False Positives
|
2016-10-29 12:28:54 +02:00 |
|
gen_cn_webshells.yar
|
Signature Updates
|
2016-04-20 09:26:09 +02:00 |
|
gen_deviceguard_evasion.yar
|
Device Guard Evasion
|
2016-08-18 08:44:27 +02:00 |
|
gen_dirtycow.yar
|
Improved DirtyCOW Rule
|
2016-10-24 16:40:54 +02:00 |
|
gen_empire.yar
|
Changed duplicate rule name
|
2016-11-12 12:26:55 +01:00 |
|
gen_faked_versions.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_gpp_cpassword.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_invoke_mimikatz.yar
|
Invoke-Mimikatz Rule
|
2016-08-10 09:35:08 +02:00 |
|
gen_kerberoast.yar
|
Kerberoast
|
2016-05-24 07:28:42 -06:00 |
|
gen_kirbi_mimkatz.yar
|
Add new mimkatz yara-signature
|
2016-08-13 18:39:22 +02:00 |
|
gen_malware_set_qa.yar
|
False Positive
|
2016-10-13 09:40:36 +02:00 |
|
gen_metasploit_loader_rsmudge.yar
|
Metasploit Loader by RSMudge
|
2016-04-21 10:31:41 +02:00 |
|
gen_mimikittenz.yar
|
Mimikittenz
|
2016-07-20 13:30:10 +02:00 |
|
gen_nopowershell.yar
|
No Powershell
|
2016-05-24 07:28:29 -06:00 |
|
gen_p0wnshell.yar
|
P0wnShell
|
2017-01-15 16:30:56 +01:00 |
|
gen_pirpi.yar
|
APT29 IOCs and Pirpi YARA Rules
|
2016-09-11 15:59:36 +02:00 |
|
gen_powerkatz.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_powershell_empire.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_powershell_toolkit.yar
|
PowerShell Toolkit YARA Rules
|
2016-09-04 18:19:57 +02:00 |
|
gen_rats_malwareconfig.yar
|
RAT YARA rules from malwareconfig.com
|
2016-12-27 23:26:07 +01:00 |
|
gen_regsrv32_issue.yar
|
Regsvr32 issue signature
|
2016-04-26 10:05:17 +02:00 |
|
gen_sharpcat.yar
|
SharpCat YARA Signature
|
2016-06-10 18:14:26 +02:00 |
|
gen_suspicious_strings.yar
|
Suspicious String - Ping in EXE
|
2016-11-05 10:32:30 +01:00 |
|
gen_sysinternals_anomaly.yar
|
SysInternals Anomalies
|
2016-12-09 00:20:38 +01:00 |
|
gen_tempracer.yar
|
Signature Update
|
2016-04-01 16:51:30 +02:00 |
|
gen_thumbs_cloaking.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
gen_transformed_strings.yar
|
OTX Update and b374k back connect shell
|
2016-08-26 21:43:11 +02:00 |
|
gen_win_privesc.yar
|
Signature Update
|
2016-06-04 17:07:38 +02:00 |
|
gen_winshells.yar
|
Signature Update
|
2016-04-01 16:51:30 +02:00 |
|
general_cloaking.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
general_officemacros.yar
|
Minor Changes to YARA Rules
|
2016-06-08 11:28:42 +02:00 |
|
generic_anomalies.yar
|
Mirai Botnet Malware and Improvements
|
2016-10-06 08:48:52 +02:00 |
|
generic_cryptors.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
generic_dumps.yar
|
Signature Update
|
2016-06-04 17:07:38 +02:00 |
|
generic_exe2hex_payload.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
pup_lightftp.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
spy_equation_fiveeyes.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
spy_querty_fiveeyes.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
spy_regin_fiveeyes.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
|
thor_inverse_matches.yar
|
Signature Updates
|
2016-04-20 09:26:09 +02:00 |
|
thor-hacktools.yar
|
FScan output
|
2017-01-14 19:28:47 +01:00 |
|
thor-webshells.yar
|
Regshell False Positive
|
2016-12-01 22:44:48 +01:00 |
|
threat_lenovo_superfish.yar
|
signatures > yara
|
2016-02-15 12:31:27 +01:00 |
