Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_Grouper2	—	—
yara	HKTL_NET_GUID_CasperStager	—	—
yara	HKTL_NET_GUID_TellMeYourSecrets	—	—
yara	HKTL_NET_GUID_SharpExcel4_DCOM	—	—
yara	HKTL_NET_GUID_SharpShooter	—	—
yara	HKTL_NET_GUID_NoMSBuild	—	—
yara	HKTL_NET_GUID_TeleShadow2	—	—
yara	wce	—	—
yara	HKTL_NET_GUID_BadPotato	—	—
yara	HKTL_NET_GUID_LethalHTA	—	—
yara	HKTL_NET_GUID_SharpStat	—	—
yara	HKTL_NET_GUID_SneakyService	—	—
yara	HKTL_NET_GUID_SharpExec	—	—
yara	HKTL_NET_GUID_SharpCOM	—	—
yara	HKTL_NET_GUID_Inception	—	—
yara	HKTL_NET_GUID_sharpwmi	—	—
yara	HKTL_NET_GUID_CVE_2019_1064	—	—
yara	HKTL_NET_GUID_Tokenvator	—	—
yara	HKTL_NET_GUID_WheresMyImplant	—	—
yara	HKTL_NET_GUID_Naga	—	—
yara	HKTL_NET_GUID_SharpBox	—	—
yara	HKTL_NET_GUID_rundotnetdll32	—	—
yara	HKTL_NET_GUID_AntiDebug	—	—
yara	HKTL_NET_GUID_DInvisibleRegistry	—	—
yara	HKTL_NET_GUID_TikiTorch	—	—
yara	HKTL_NET_GUID_HiveJack	—	—
yara	HKTL_NET_GUID_DecryptAutoLogon	—	—
yara	HKTL_NET_GUID_UnstoppableService	—	—
yara	HKTL_NET_GUID_SharpWMI	—	—
yara	HKTL_NET_GUID_EWSToolkit	—	—
yara	HKTL_NET_GUID_SweetPotato	—	—
yara	HKTL_NET_GUID_memscan	—	—
yara	HKTL_NET_GUID_SharpStay	—	—
yara	HKTL_NET_GUID_SharpLocker	—	—
yara	HKTL_NET_GUID_SauronEye	—	—
yara	HKTL_NET_GUID_sitrep	—	—
yara	HKTL_NET_GUID_SharpClipboard	—	—
yara	HKTL_NET_GUID_SharpCookieMonster	—	—
yara	HKTL_NET_GUID_p0wnedShell	—	—
yara	HKTL_NET_GUID_SharpMove	—	—