Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_WindowsDefender_Payload_Downloader	—	—
yara	HKTL_NET_GUID_Salsa_tools	—	—
yara	HKTL_NET_GUID_SharpPack	—	—
yara	HKTL_NET_GUID_SharpBypassUAC	—	—
yara	HKTL_NET_GUID_Minidump	—	—
yara	HKTL_NET_GUID_Simple_Loader	—	—
yara	HKTL_NET_GUID_Rubeus	—	—
yara	HKTL_NET_GUID_OSSFileTool	—	—
yara	HKTL_NET_GUID_Carbuncle	—	—
yara	HKTL_NET_GUID_SharpCompile	—	—
yara	HKTL_NET_GUID_Telegra_Csharp_C2	—	—
yara	HKTL_NET_GUID_SharpDPAPI	—	—
yara	HKTL_NET_GUID_DotNetAVBypass_Master	—	—
yara	HKTL_NET_GUID_HideFromAMSI	—	—
yara	HKTL_NET_GUID_MultiOS_ReverseShell	—	—
yara	HKTL_NET_GUID_BYTAGE	—	—
yara	HKTL_NET_GUID_clr_meterpreter	—	—
yara	HKTL_NET_GUID_hanzoInjection	—	—
yara	HKTL_NET_GUID_BypassUAC	—	—
yara	HKTL_NET_GUID_SharpCradle	—	—
yara	HKTL_NET_GUID_Stealth_Kid_RAT	—	—
yara	HKTL_NET_GUID_EducationalRAT	—	—
yara	HKTL_NET_GUID_SharpDump	—	—
yara	HKTL_NET_GUID_UglyEXe	—	—
yara	HKTL_NET_GUID_wsManager	—	—
yara	HKTL_NET_GUID_DesktopGrabber	—	—
yara	HKTL_NET_GUID_UAC_SilentClean	—	—
yara	HKTL_NET_GUID_Dropless_Malware	—	—
yara	HKTL_NET_GUID_SafetyKatz	—	—
yara	HKTL_NET_GUID_Obfuscator	—	—
yara	HKTL_NET_GUID_SharpSpray	—	—
yara	HKTL_NET_GUID_Misc_CSharp	—	—
yara	HKTL_NET_GUID_WindowsPlague	—	—
yara	HKTL_NET_GUID_SharpTask	—	—
yara	HKTL_NET_GUID_bantam	—	—
yara	HKTL_NET_GUID_Csharp_Loader	—	—
yara	HKTL_NET_GUID_ESC	—	—
yara	HKTL_NET_GUID_RedSharp	—	—
yara	HKTL_NET_GUID_DreamProtectorFree	—	—
yara	HKTL_NET_GUID_HastySeries	—	—