Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	EliseLotusBlossom	—	—
yara	apt_RU_MoonlightMaze_encrypted_keylog	—	—
yara	Regin_APT_KernelDriver_Generic_A	—	—
yara	Regin_APT_KernelDriver_Generic_B	—	—
yara	Regin_APT_KernelDriver_Generic_C	—	—
yara	Regin_sig_svcsstat	—	—
yara	Regin_Sample_Set_2	—	—
yara	Regin_Sample_1	—	—
yara	Regin_Sample_2	—	—
yara	Regin_Sample_3	—	—
yara	Regin_Sample_Set_1	—	—
yara	apt_regin_legspin	—	—
yara	apt_regin_hopscotch	—	—
yara	apt_regin_2011_32bit_stage1	—	—
yara	apt_regin_rc5key	—	—
yara	apt_regin_vfs	—	—
yara	apt_regin_dispatcher_disp_dll	—	—
yara	apt_regin_2013_64bit_stage1	—	—
yara	remsec_executable_blob_32	—	—
yara	apt_ProjectSauron_pipe_backdoor	—	—
yara	apt_ProjectSauron_encrypted_LSA	—	—
yara	apt_ProjectSauron_encrypted_SSPI	—	—
yara	apt_ProjectSauron_MyTrampoline	—	—
yara	apt_ProjectSauron_encrypted_container	—	—
yara	apt_ProjectSauron_encryption	—	—
yara	apt_ProjectSauron_generic_pipe_backdoor	—	—
yara	APT_Project_Sauron_Scripts	—	—
yara	APT_Project_Sauron_arping_module	—	—
yara	APT_Project_Sauron_kblogi_module	—	—
yara	APT_Project_Sauron_basex_module	—	—
yara	APT_Project_Sauron_dext_module	—	—
yara	Hacktool_This_Cruft	—	—
yara	APT_Project_Sauron_Custom_M1	—	—
yara	APT_Project_Sauron_Custom_M2	—	—
yara	APT_Project_Sauron_Custom_M3	—	—
yara	APT_Project_Sauron_Custom_M4	—	—
yara	APT_Project_Sauron_Custom_M6	—	—
yara	APT_Project_Sauron_Custom_M7	—	—
yara	Scieron	—	—
yara	SeaDuke_Sample	—	—