Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RideArea2_12	—	—
yara	BangatCode	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_13	—	—
yara	EquationGroup_Toolset_Apr17__NameProbe_SMBTOUCH_14	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15	—	—
yara	EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16	—	—
yara	EquationGroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17	—	—
yara	EquationGroup_scanner_output	—	—
yara	COZY_FANCY_BEAR_Hunt	—	—
yara	COZY_FANCY_BEAR_pagemgr_Hunt	—	—
yara	APT_fancybear_Downdelph_magic	—	—
yara	APT_fancybear_Downdelph_MBR	—	—
yara	Furtim_nativeDLL	—	—
yara	Furtim_Parent_1	—	—
yara	agenttesla_smtp_variant	—	—
yara	BeEF_browser_hooked	—	—
yara	GEN_PowerShell	—	—
yara	Generic_ATMPot	—	—
yara	ATM_HelloWorld	—	—
yara	Windows_Malware	—	—
yara	Agenttesla	—	—
yara	Empire_Invoke_SmbScanner	—	—
yara	Empire_Exploit_JBoss	—	—
yara	Empire_dumpCredStore	—	—
yara	Empire_Invoke_EgressCheck	—	—
yara	Empire_ReflectivePick_x64_orig	—	—
yara	Empire_Out_Minidump	—	—
yara	Empire_Invoke_PsExec	—	—
yara	Empire_Invoke_PostExfil	—	—
yara	Empire_Invoke_SMBAutoBrute	—	—
yara	Empire_Get_Keystrokes	—	—
yara	Empire_Invoke_DllInjection	—	—
yara	Empire_KeePassConfig	—	—
yara	Empire_Invoke_SSHCommand	—	—
yara	Empire_PowerShell_Framework_Gen1	—	—
yara	Empire_PowerUp_Gen	—	—
yara	Empire_PowerShell_Framework_Gen2	—	—
yara	Empire_Agent_Gen	—	—
yara	Empire_PowerShell_Framework_Gen3	—	—
yara	Empire_Invoke_InveighRelay_Gen	—	—