Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_DesktopGrabber	—	—
yara	HKTL_NET_GUID_wsManager	—	—
yara	HKTL_NET_GUID_UglyEXe	—	—
yara	HKTL_NET_GUID_SharpDump	—	—
yara	HKTL_NET_GUID_EducationalRAT	—	—
yara	HKTL_NET_GUID_Stealth_Kid_RAT	—	—
yara	HKTL_NET_GUID_SharpCradle	—	—
yara	HKTL_NET_GUID_BypassUAC	—	—
yara	HKTL_NET_GUID_hanzoInjection	—	—
yara	HKTL_NET_GUID_clr_meterpreter	—	—
yara	HKTL_NET_GUID_BYTAGE	—	—
yara	HKTL_NET_GUID_MultiOS_ReverseShell	—	—
yara	HKTL_NET_GUID_HideFromAMSI	—	—
yara	HKTL_NET_GUID_DotNetAVBypass_Master	—	—
yara	HKTL_NET_GUID_SharpDPAPI	—	—
yara	HKTL_NET_GUID_Telegra_Csharp_C2	—	—
yara	HKTL_NET_GUID_SharpCompile	—	—
yara	HKTL_NET_GUID_Carbuncle	—	—
yara	HKTL_NET_GUID_OSSFileTool	—	—
yara	HKTL_NET_GUID_Rubeus	—	—
yara	HKTL_NET_GUID_Simple_Loader	—	—
yara	HKTL_NET_GUID_Minidump	—	—
yara	HKTL_NET_GUID_SharpBypassUAC	—	—
yara	HKTL_NET_GUID_SharpPack	—	—
yara	HKTL_NET_GUID_Salsa_tools	—	—
yara	HKTL_NET_GUID_WindowsDefender_Payload_Downloader	—	—
yara	HKTL_NET_GUID_Privilege_Escalation	—	—
yara	HKTL_NET_GUID_Marauder	—	—
yara	HKTL_NET_GUID_AV_Evasion_Tool	—	—
yara	HKTL_NET_GUID_Fenrir	—	—
yara	HKTL_NET_GUID_StormKitty	—	—
yara	HKTL_NET_GUID_Crypter_Runtime_AV_s_bypass	—	—
yara	HKTL_NET_GUID_RunAsUser	—	—
yara	HKTL_NET_GUID_HWIDbypass	—	—
yara	HKTL_NET_GUID_XORedReflectiveDLL	—	—
yara	HKTL_NET_GUID_Sharp_Suite	—	—
yara	HKTL_NET_GUID_rat_shell	—	—
yara	HKTL_NET_GUID_dotnet_gargoyle	—	—
yara	HKTL_NET_GUID_aresskit	—	—
yara	HKTL_NET_GUID_DLL_Injector	—	—