Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_Marauder	—	—
yara	HKTL_NET_GUID_AV_Evasion_Tool	—	—
yara	HKTL_NET_GUID_Fenrir	—	—
yara	HKTL_NET_GUID_StormKitty	—	—
yara	HKTL_NET_GUID_Crypter_Runtime_AV_s_bypass	—	—
yara	HKTL_NET_GUID_RunAsUser	—	—
yara	HKTL_NET_GUID_HWIDbypass	—	—
yara	HKTL_NET_GUID_XORedReflectiveDLL	—	—
yara	HKTL_NET_GUID_Sharp_Suite	—	—
yara	HKTL_NET_GUID_WindowsRpcClients	—	—
yara	HKTL_NET_GUID_SharpFruit	—	—
yara	HKTL_NET_GUID_SharpWitness	—	—
yara	HKTL_NET_GUID_RexCrypter	—	—
yara	HKTL_NET_GUID_SharPersist	—	—
yara	HKTL_NET_GUID_CVE_2019_1253	—	—
yara	HKTL_NET_GUID_scout	—	—
yara	HKTL_NET_GUID_Grouper2	—	—
yara	HKTL_NET_GUID_CasperStager	—	—
yara	HKTL_NET_GUID_TellMeYourSecrets	—	—
yara	HKTL_NET_GUID_SharpExcel4_DCOM	—	—
yara	HKTL_NET_GUID_SharpShooter	—	—
yara	HKTL_NET_GUID_NoMSBuild	—	—
yara	HKTL_NET_GUID_TeleShadow2	—	—
yara	wce	—	—
yara	HKTL_NET_GUID_BadPotato	—	—
yara	HKTL_NET_GUID_LethalHTA	—	—
yara	HKTL_NET_GUID_SharpStat	—	—
yara	HKTL_NET_GUID_SneakyService	—	—
yara	HKTL_NET_GUID_SharpExec	—	—
yara	HKTL_NET_GUID_SharpCOM	—	—
yara	HKTL_NET_GUID_Inception	—	—
yara	HKTL_NET_GUID_sharpwmi	—	—
yara	HKTL_NET_GUID_CVE_2019_1064	—	—
yara	HKTL_NET_GUID_Tokenvator	—	—
yara	HKTL_NET_GUID_WheresMyImplant	—	—
yara	HKTL_NET_GUID_Naga	—	—
yara	HKTL_NET_GUID_SharpBox	—	—
yara	HKTL_NET_GUID_rundotnetdll32	—	—
yara	HKTL_NET_GUID_AntiDebug	—	—
yara	HKTL_NET_GUID_DInvisibleRegistry	—	—