Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	scriptkiddies	—	—
yara	eval_with_comments	—	—
yara	PM_Email_Sent_By_PHP_Script	—	—
yara	PM_Zip_with_js	—	—
yara	APT1_WEBC2_RAVE	—	—
yara	APT1_WEBC2_GREENCAT	—	—
yara	Rooter	—	—
yara	RookieStrings	—	—
yara	CALENDAR_APT1	—	—
yara	SType_Backdoor	—	—
yara	COMBOS_APT1	—	—
yara	DAIRY_APT1	—	—
yara	BOUNCER_DLL_APT1	—	—
yara	HACKSFASE1_APT1	—	—
yara	malware_apt15_bs2005	—	—
yara	malware_apt15_royaldll	—	—
yara	malware_apt15_royaldll_2	—	—
yara	malware_apt15_exchange_tool	—	—
yara	malware_apt15_generic	—	—
yara	APT17_Sample_FXSST_DLL	—	—
yara	GRIZZLY_STEPPE_Malware_1	—	—
yara	GRIZZLY_STEPPE_Malware_2	—	—
yara	PAS_TOOL_PHP_WEB_KIT_mod	—	—
yara	WebShell_PHP_Web_Kit_v3	—	—
yara	WebShell_PHP_Web_Kit_v4	—	—
yara	APT3102Code	—	—
yara	APT3102Strings	—	—
yara	APT9002Code	—	—
yara	APT9002Strings	—	—
yara	APT9002	—	—
yara	FE_APT_9002	—	—
yara	apt_backspace	—	—
yara	APT_bestia	—	—
yara	BlackEnergy_BE_2	—	—
yara	BlackEnergy_VBS_Agent	—	—
yara	apt_c16_win_memory_pcclient	—	—
yara	DropBear_SSH_Server	—	—
yara	BlackEnergy_BackdoorPass_DropBear_SSH	—	—
yara	BlackEnergy_KillDisk_1	—	—
yara	BlackEnergy_KillDisk_2	—	—