Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	EquationGroup_Toolset_Apr17_PC_Level_Generic	—	—
yara	EquationGroup_Toolset_Apr17_PC_Level3_http_exe	—	—
yara	EquationGroup_Toolset_Apr17_ParseCapture	—	—
yara	EquationGroup_Toolset_Apr17_ActiveDirectory_Target	—	—
yara	EquationGroup_Toolset_Apr17_PC_Legacy_dll	—	—
yara	EquationGroup_Toolset_Apr17_svctouch	—	—
yara	EquationGroup_Toolset_Apr17_pwd_Implant	—	—
yara	EquationGroup_Toolset_Apr17_KisuComms_Target_2000	—	—
yara	AthenaHTTP_v2	—	—
yara	EquationGroup_Toolset_Apr17_SlDecoder	—	—
yara	EquationGroup_Toolset_Apr17_Windows_Implant	—	—
yara	EquationGroup_Toolset_Apr17_msgkd_msslu64_msgki_mssld	—	—
yara	EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_3	—	—
yara	EquationGroup_Toolset_Apr17_SetCallback	—	—
yara	EquationGroup_Toolset_Apr17__DoubleFeatureReader_DoubleFeatureReader_0	—	—
yara	EquationGroup_Toolset_Apr17__vtuner_vtuner_1	—	—
yara	EquationGroup_Toolset_Apr17__ecwi_ESKE_EVFR_RPC2_2	—	—
yara	EquationGroup_Toolset_Apr17__EAFU_ecwi_ESKE_EVFR_RPC2_4	—	—
yara	EquationGroup_Toolset_Apr17__SendCFTrigger_SendPKTrigger_6	—	—
yara	EquationGroup_Toolset_Apr17__AddResource	—	—
yara	backoff	—	—
yara	EquationGroup_Toolset_Apr17__ESKE_RPC2_8	—	—
yara	EquationGroup_Toolset_Apr17__LSADUMP_Lp_ModifyPrivilege_Lp_PacketScan_Lp_put_Lp_RemoteExecute_Lp_Windows_Lp_wmi_Lp_9	—	—
yara	EquationGroup_Toolset_Apr17__ETBL_ETRE_10	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12	—	—
yara	BangatCode	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_13	—	—
yara	EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16	—	—
yara	EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17	—	—
yara	EquationGroup_scanner_output	—	—
yara	COZY_FANCY_BEAR_Hunt	—	—
yara	COZY_FANCY_BEAR_pagemgr_Hunt	—	—
yara	APT_fancybear_Downdelph_magic	—	—
yara	APT_fancybear_Downdelph_MBR	—	—
yara	Furtim_nativeDLL	—	—
yara	Furtim_Parent_1	—	—
yara	agenttesla_smtp_variant	—	—

← Prev Next →