Detection rules
Every rule tracked across all seven sources, newest updates first.
| Source | Rule | Status | Updated |
|---|---|---|---|
| yara | Datper | — | — |
| yara | SmokeLoader | — | — |
| yara | Emotet | — | — |
| yara | Ursnif | — | — |
| yara | zark20rk | — | — |
| yara | Armadill | — | — |
| yara | Lavender | — | — |
| yara | Himawari | — | — |
| yara | RedLeaves | — | — |
| yara | CobaltStrike | — | — |
| yara | xDedic_SysScan_unpacked | — | — |
| yara | viotto_keylogger | — | — |
| yara | sitrof_fortis_scar | — | — |
| yara | shifu_shiz | — | — |
| yara | marap | — | — |
| yara | kpot | — | — |
| yara | c99shell | — | — |
| yara | FSO_s_ajan | — | — |
| yara | ZXshell2_0_rar_Folder_zxrecv | — | — |
| yara | FSO_s_phpinj_2 | — | — |
| yara | screencap | — | — |
| yara | xssshell_save | — | — |
| yara | PHP_Shell_v1_7 | — | — |
| yara | regshell | — | — |
| yara | shelltools_g0t_root_HideRun | — | — |
| yara | connector | — | — |
| yara | Debug_dllTest_2 | — | — |
| yara | fmlibraryv3 | — | — |
| yara | peek_a_boo | — | — |
| yara | Mithril_dllTest | — | — |
| yara | by064cli | — | — |
| yara | EditServer_Webshell_2 | — | — |
| yara | xssshell_default | — | — |
| yara | PHP_sh | — | — |
| yara | FSO_s_phpinj | — | — |
| yara | FeliksPack3___PHP_Shells_usr | — | — |
| yara | xssshell | — | — |
| yara | HYTop_AppPack_2005 | — | — |
| yara | FeliksPack3___PHP_Shells_xIShell | — | — |
| yara | adjustcr | — | — |