Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	apt_ProjectSauron_encrypted_SSPI	—	—
yara	apt_ProjectSauron_MyTrampoline	—	—
yara	apt_ProjectSauron_encrypted_container	—	—
yara	apt_ProjectSauron_encryption	—	—
yara	apt_ProjectSauron_generic_pipe_backdoor	—	—
yara	APT_Project_Sauron_Scripts	—	—
yara	APT_Project_Sauron_arping_module	—	—
yara	APT_Project_Sauron_kblogi_module	—	—
yara	APT_Project_Sauron_basex_module	—	—
yara	APT_Project_Sauron_dext_module	—	—
yara	Hacktool_This_Cruft	—	—
yara	APT_Project_Sauron_Custom_M1	—	—
yara	APT_Project_Sauron_Custom_M2	—	—
yara	APT_Project_Sauron_Custom_M3	—	—
yara	APT_Project_Sauron_Custom_M4	—	—
yara	APT_Project_Sauron_Custom_M6	—	—
yara	APT_Project_Sauron_Custom_M7	—	—
yara	Scieron	—	—
yara	SeaDuke_Sample	—	—
yara	susp_file_enumerator_with_encrypted_resource_101	—	—
yara	StoneDrill_main_sub	—	—
yara	SNOWGLOBE_Babar_Malware	—	—
yara	apt_sofacy_xtunnel	—	—
yara	RUAG_Bot_Config_File	—	—
yara	Sofacy_Bundestag_Winexe	—	—
yara	Sofacy_Bundestag_Mal2	—	—
yara	Sofacy_Bundestag_Mal3	—	—
yara	Sofacy_Bundestag_Batch	—	—
yara	Sofacy_Fybis_ELF_Backdoor_Gen1	—	—
yara	Sphinx_Moth_iastor32	—	—
yara	Sofacy_Fysbis_ELF_Backdoor_Gen2	—	—
yara	Sofacy_Jun16_Sample1	—	—
yara	Sofacy_Jun16_Sample2	—	—
yara	Sofacy_Jun16_Sample3	—	—
yara	Sphinx_Moth_cudacrt	—	—
yara	Sphinx_Moth_h2t	—	—
yara	XOR_DDosv1	—	—
yara	Sphinx_Moth_kerberos32	—	—
yara	Sphinx_Moth_kerberos64	—	—
yara	Sphinx_Moth_nvcplex	—	—