Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_CinaRAT	—	—
yara	HKTL_NET_GUID_ToxicEye	—	—
yara	HKTL_NET_GUID_Disable_Windows_Defender	—	—
yara	HKTL_NET_GUID_DInvoke_PoC	—	—
yara	HKTL_NET_GUID_ReverseShell	—	—
yara	HKTL_NET_GUID_SharpC2	—	—
yara	HKTL_NET_GUID_SneakyExec	—	—
yara	HKTL_NET_GUID_UrbanBishopLocal	—	—
yara	HKTL_NET_GUID_SharpShell	—	—
yara	HKTL_NET_GUID_EvilWMIProvider	—	—
yara	HKTL_NET_GUID_GadgetToJScript	—	—
yara	HKTL_NET_GUID_AzureCLI_Extractor	—	—
yara	HKTL_NET_GUID_UAC_Escaper	—	—
yara	HKTL_NET_GUID_HTTPSBeaconShell	—	—
yara	HKTL_NET_GUID_AmsiScanBufferBypass	—	—
yara	HKTL_NET_GUID_ShellcodeLoader	—	—
yara	HKTL_NET_GUID_KeystrokeAPI	—	—
yara	HKTL_NET_GUID_ShellCodeRunner	—	—
yara	Hacktools_CN_Panda_tasksvr	—	—
yara	HKTL_NET_GUID_SharpSearch	—	—
yara	HKTL_NET_GUID_SharpSecDump	—	—
yara	HKTL_NET_GUID_Net_GPPPassword	—	—
yara	HKTL_NET_GUID_FileSearcher	—	—
yara	HKTL_NET_GUID_ADFSDump	—	—
yara	HKTL_NET_GUID_SharpRDP	—	—
yara	HKTL_NET_GUID_SharpCall	—	—
yara	HKTL_NET_GUID_ysoserial_net	—	—
yara	HKTL_NET_GUID_ManagedInjection	—	—
yara	HKTL_NET_GUID_SharpSocks	—	—
yara	HKTL_NET_GUID_Sharp_WMIExec	—	—
yara	HKTL_NET_GUID_KeeThief	—	—
yara	HKTL_NET_GUID_fakelogonscreen	—	—
yara	HKTL_NET_GUID_PoshSecFramework	—	—
yara	HKTL_NET_GUID_SharpAttack	—	—
yara	HKTL_NET_GUID_Altman	—	—
yara	HKTL_NET_GUID_BrowserPass	—	—
yara	HKTL_NET_GUID_Mythic	—	—
yara	HKTL_NET_GUID_Nuages	—	—
yara	HKTL_NET_GUID_SharpSniper	—	—
yara	HKTL_NET_GUID_SharpHound3	—	—