Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
sentinel	Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)	Scheduled	—
sentinel	DNS events related to mining pools (ASIM DNS Schema)	Scheduled	—
sentinel	Potential Password Spray Attack (Uses Authentication Normalization)	Scheduled	—
sentinel	A client made a web request to a potentially harmful file (ASIM Web Session schema)	Scheduled	—
sentinel	User login from different countries within 3 hours (Uses Authentication Normalization)	Scheduled	—
yara	VidgrabStrings	—	—
yara	Vidgrab	—	—
yara	TSC_Loader	—	—
yara	VirutFileInfector	—	—
yara	volgmer	—	—
yara	Wabot	—	—
yara	WarpCode	—	—
yara	WarpStrings	—	—
yara	Warp	—	—
yara	WimmieShellcode	—	—
yara	WimmieStrings	—	—
yara	Wimmie	—	—
yara	XHide	—	—
yara	yordanyan_activeagent	—	—
yara	Zegost	—	—
yara	Windows_Malware_Zeus	—	—
yara	Adwind	—	—
yara	hancitor	—	—
yara	mimikatz_kirbi_ticket	—	—
yara	TSCookie	—	—
yara	Wanna_Sample_4da1f312a214c07143abeeafb695d904	—	—
yara	NHS_Strain_Wanna	—	—
yara	ransom_telefonica	—	—
yara	Wanna_Cry_Ransomware_Generic	—	—
yara	WannaCry_Ransomware	—	—
yara	DarkComet_Keylogger_File	—	—
yara	WannaCry_Ransomware_Gen	—	—
yara	WannCry_m_vbs	—	—
yara	WannCry_BAT	—	—
yara	WannaCry_RansomNote	—	—
yara	lazaruswannacry	—	—
yara	WannaCry_Ransomware_Dropper	—	—
yara	DarkComet_4	—	—
yara	WannaCry_SMB_Exploit	—	—
yara	wannacry_static_ransom	—	—