Detection rules
Every rule tracked across all seven sources, newest updates first.
| Source | Rule | Status | Updated |
|---|---|---|---|
| yara | chinese_spam_echoer | — | — |
| yara | fire2013 | — | — |
| yara | multiple_webshells_0002 | — | — |
| yara | CPUInfoExtraction | — | — |
| yara | SuicideScriptL1 | — | — |
| yara | SuicideScriptR1_Multi | — | — |
| yara | SuicideScriptR | — | — |
| yara | blackpos_v2 | — | — |
| yara | dump_tool | — | — |
| yara | osql_tool | — | — |
| yara | misc_pos | — | — |
| yara | unknown | — | — |
| yara | heistenberg_pos | — | — |
| yara | regex_pos | — | — |
| yara | regexpr_pos | — | — |
| yara | reg_pos | — | — |
| yara | sets_pos | — | — |
| yara | monitor_tool_pos | — | — |
| yara | pstgdump | — | — |
| yara | keyfinder_tool | — | — |
| yara | memdump_diablo | — | — |
| yara | blazingtools | — | — |
| yara | sysocmgr | — | — |
| yara | lacy_keylogger | — | — |
| yara | pos_memory_scrapper_ | — | — |
| yara | pos_malwre_dexter_stardust | — | — |
| yara | pos_malware_project_hook | — | — |
| yara | pdb_strings_Rescator | — | — |
| yara | pos_uploader | — | — |
| yara | winxml_dll | — | — |
| yara | pos_chewbacca | — | — |
| yara | BernhardPOS | — | — |
| yara | POS_bruteforcing_bot | — | — |
| yara | easterjackpos | — | — |
| yara | PoS_Malware_fastpos | — | — |
| yara | LogPOS | — | — |
| yara | PoS_Malware_MalumPOS | — | — |
| yara | Mozart | — | — |
| yara | Ransom_CryptXXX_Dropper | — | — |
| yara | Ransom_CryptXXX_Real | — | — |