Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_SharpDir	—	—
yara	HKTL_NET_GUID_AtYourService	—	—
yara	HKTL_NET_GUID_LockLess	—	—
yara	HKTL_NET_GUID_EasyNet	—	—
yara	FSO_s_zehir4	—	—
yara	HKTL_NET_GUID_SharpByeBear	—	—
yara	HKTL_NET_GUID_SharpHide	—	—
yara	HKTL_NET_GUID_SharpSvc	—	—
yara	HKTL_NET_GUID_SharpCrashEventLog	—	—
yara	HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout	—	—
yara	HKTL_NET_GUID_SharPermission	—	—
yara	HKTL_NET_GUID_RegistryStrikesBack	—	—
yara	PortScanner	—	—
yara	Hacktools_CN_Burst_sql	—	—
yara	Hacktools_CN_Panda_445TOOL	—	—
yara	Hacktools_CN_Panda_445	—	—
yara	Hacktools_CN_WinEggDrop	—	—
yara	Hacktools_CN_Scan_BAT	—	—
yara	Hacktools_CN_Panda_Burst	—	—
yara	Hacktools_CN_445_cmd	—	—
yara	Hacktools_CN_GOGOGO_Bat	—	—
yara	Hacktools_CN_Burst_pass	—	—
yara	Hacktools_CN_JoHor_Posts_Killer	—	—
yara	Hacktools_CN_Panda_tesksd	—	—
yara	Hacktools_CN_Http	—	—
yara	Hacktools_CN_Burst_Start	—	—
yara	webshell_cmd_asp_5_1	—	—
yara	Hacktools_CN_Burst_Clear	—	—
yara	Hacktools_CN_Burst_Thecard	—	—
yara	Hacktools_CN_Burst_Blast	—	—
yara	VUBrute_VUBrute	—	—
yara	DK_Brute	—	—
yara	VUBrute_config	—	—
yara	sig_238_hunt	—	—
yara	sig_238_listip	—	—
yara	ArtTrayHookDll	—	—
yara	sig_238_eee	—	—
yara	aspbackdoor_asp4	—	—
yara	aspfile1	—	—
yara	EditServer_HackTool	—	—