Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_SharpAdidnsdump	—	—
yara	HKTL_NET_GUID_Quasar	—	—
yara	HKTL_NET_GUID_UnmanagedPowerShell	—	—
yara	HKTL_NET_GUID_VanillaRAT	—	—
yara	HKTL_NET_GUID_MemoryMapper	—	—
yara	HKTL_NET_GUID_MiscTools	—	—
yara	HKTL_NET_GUID_Inferno	—	—
yara	HKTL_NET_GUID_Sharp_SMBExec	—	—
yara	HKTL_NET_GUID_Sharpire	—	—
yara	HKTL_NET_GUID_PoshC2_Misc	—	—
yara	HKTL_NET_GUID_EvilFOCA	—	—
yara	HKTL_NET_GUID_SharpPrinter	—	—
yara	HKTL_NET_GUID_C_Sharp_R_A_T_Client	—	—
yara	HKTL_NET_GUID_SharpMove	—	—
yara	HKTL_NET_GUID_p0wnedShell	—	—
yara	HKTL_NET_GUID_SharpCookieMonster	—	—
yara	HKTL_NET_GUID_SharpClipboard	—	—
yara	HKTL_NET_GUID_sitrep	—	—
yara	HKTL_NET_GUID_SauronEye	—	—
yara	HKTL_NET_GUID_SharpLocker	—	—
yara	HKTL_NET_GUID_SharpStay	—	—
yara	HKTL_NET_GUID_memscan	—	—
yara	HKTL_NET_GUID_SweetPotato	—	—
yara	HKTL_NET_GUID_EWSToolkit	—	—
yara	HKTL_NET_GUID_SharpWMI	—	—
yara	HKTL_NET_GUID_UnstoppableService	—	—
yara	HKTL_NET_GUID_DecryptAutoLogon	—	—
yara	HKTL_NET_GUID_HiveJack	—	—
yara	HKTL_NET_GUID_TikiTorch	—	—
yara	HKTL_NET_GUID_DInvisibleRegistry	—	—
yara	HKTL_NET_GUID_AntiDebug	—	—
yara	HKTL_NET_GUID_rundotnetdll32	—	—
yara	HKTL_NET_GUID_SharpBox	—	—
yara	HKTL_NET_GUID_Naga	—	—
yara	HKTL_NET_GUID_WheresMyImplant	—	—
yara	HKTL_NET_GUID_Tokenvator	—	—
yara	HKTL_NET_GUID_CVE_2019_1064	—	—
yara	HKTL_NET_GUID_sharpwmi	—	—
yara	HKTL_NET_GUID_Inception	—	—
yara	HKTL_NET_GUID_SharpCOM	—	—