Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	EQGRP_eligiblebombshell_generic	—	—
yara	msvcrt_WIN8AMD64	—	—
yara	EQGRP_ssh_telnet_29	—	—
yara	EQGRP_tinyexec	—	—
yara	EQGRP_callbacks	—	—
yara	EQGRP_Extrabacon_Output	—	—
yara	EQGRP_Unique_Strings	—	—
yara	EQGRP_RC5_RC6_Opcode	—	—
yara	Emissary_APT_Malware_1	—	—
yara	Backdoored_ssh	—	—
yara	msvcrt_WIN8x86	—	—
yara	apt_equation_doublefantasy_genericresource	—	—
yara	apt_equation_equationlaser_runtimeclasses	—	—
yara	apt_equation_cryptotable	—	—
yara	Equation_Kaspersky_TripleFantasy_1	—	—
yara	Equation_Kaspersky_DoubleFantasy_1	—	—
yara	Equation_Kaspersky_GROK_Keylogger	—	—
yara	Equation_Kaspersky_EquationDrugInstaller	—	—
yara	Equation_Kaspersky_EquationLaserInstaller	—	—
yara	Equation_Kaspersky_FannyWorm	—	—
yara	Equation_Kaspersky_HDD_reprogramming_module	—	—
yara	Equation_Kaspersky_EOP_Package	—	—
yara	msvcrt_WinXPx86	—	—
yara	Equation_Kaspersky_TripleFantasy_Loader	—	—
yara	Equation_Kaspersky_SuspiciousString	—	—
yara	EquationDrug_NetworkSniffer1	—	—
yara	EquationDrug_CompatLayer_UnilayDLL	—	—
yara	EquationDrug_HDDSSD_Op	—	—
yara	EquationDrug_NetworkSniffer2	—	—
yara	Network_Win7AMD64	—	—
yara	IMPLANT_2_v15	—	—
yara	IMPLANT_2_v16	—	—
yara	IMPLANT_2_v17	—	—
yara	IMPLANT_2_v18	—	—
yara	IMPLANT_2_v19	—	—
yara	IMPLANT_4_v3_AlternativeRule	—	—
yara	IMPLANT_2_v20	—	—
yara	IMPLANT_3_v1	—	—
yara	IMPLANT_3_v2	—	—
yara	IMPLANT_3_v3	—	—