Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	apt_c16_win_memory_pcclient	—	—
yara	DropBear_SSH_Server	—	—
yara	BlackEnergy_BackdoorPass_DropBear_SSH	—	—
yara	BlackEnergy_KillDisk_1	—	—
yara	BlackEnergy_KillDisk_2	—	—
yara	BlackEnergy_Driver_USBMDM	—	—
yara	BlackEnergy_Driver_AMDIDE	—	—
yara	Emdivi_SFX	—	—
yara	Emdivi_Gen1	—	—
yara	Emdivi_Gen2	—	—
yara	Emdivi_Gen3	—	—
yara	Emdivi_Gen4	—	—
yara	apt_c16_win_disk_pcclient	—	—
yara	apt_c16_win32_dropper	—	—
yara	apt_c16_win_swisyn	—	—
yara	apt_c16_win_wateringhole	—	—
yara	apt_c16_win64_dropper	—	—
yara	Carbanak_0915_1	—	—
yara	Carbanak_0915_2	—	—
yara	Carbanak_0915_3	—	—
yara	Careto_SGH	—	—
yara	Careto_OSX_SBD	—	—
yara	Careto_CnC	—	—
yara	Careto_CnC_domains	—	—
yara	Casper_Backdoor_x86	—	—
yara	Casper_EXE_Dropper	—	—
yara	Casper_Included_Strings	—	—
yara	Casper_SystemInformation_Output	—	—
yara	CheshireCat_Sample2	—	—
yara	CheshireCat_Gen1	—	—
yara	CheshireCat_Gen2	—	—
yara	dragos_crashoverride_configReader	—	—
yara	Dubnium_Sample_1	—	—
yara	Dubnium_Sample_2	—	—
yara	Dubnium_Sample_3	—	—
yara	Dubnium_Sample_5	—	—
yara	Dubnium_Sample_6	—	—
yara	APT_Kaspersky_Duqu2_procexp	—	—
yara	Dubnium_Sample_7	—	—
yara	Dubnium_Sample_SSHOpenSSL	—	—