Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	EquationGroup_Toolset_Apr17_promiscdetect_safe	—	—
yara	md5_4b69af81b89ba444204680d506a8e0a1	—	—
yara	EquationGroup_Toolset_Apr17_PacketScan_Implant	—	—
yara	EquationGroup_Toolset_Apr17_SetPorts	—	—
yara	EquationGroup_Toolset_Apr17_GrDo_FileScanner_Implant	—	—
yara	EquationGroup_Toolset_Apr17_msgks_mskgu	—	—
yara	EquationGroup_Toolset_Apr17_Ifconfig_Target	—	—
yara	EquationGroup_Toolset_Apr17_DiBa_Target	—	—
yara	Batel_export_function	—	—
yara	EquationGroup_Toolset_Apr17_Dsz_Implant	—	—
yara	EquationGroup_Toolset_Apr17_GenKey	—	—
yara	EquationGroup_Toolset_Apr17_wmi_Implant	—	—
yara	EquationGroup_Toolset_Apr17_clocksvc	—	—
yara	EquationGroup_Toolset_Apr17_xxxRIDEAREA	—	—
yara	EquationGroup_Toolset_Apr17_yak_min_install	—	—
yara	success_fail_codes_fallchill	—	—
yara	EquationGroup_Toolset_Apr17_SetOurAddr	—	—
yara	EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant	—	—
yara	EquationGroup_Toolset_Apr17_SendPKTrigger	—	—
yara	EquationGroup_Toolset_Apr17_DmGz_Target_2	—	—
yara	EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip	—	—
yara	EquationGroup_Toolset_Apr17_regprobe	—	—
yara	Empire_Invoke_SmbScanner	—	—
yara	Empire_Exploit_JBoss	—	—
yara	Empire_dumpCredStore	—	—
yara	Empire_Invoke_EgressCheck	—	—
yara	Empire_ReflectivePick_x64_orig	—	—
yara	Empire_Out_Minidump	—	—
yara	Empire_Invoke_PsExec	—	—
yara	Empire_Invoke_PostExfil	—	—
yara	Empire_Invoke_SMBAutoBrute	—	—
yara	Empire_Get_Keystrokes	—	—
yara	Empire_Invoke_DllInjection	—	—
yara	Empire_KeePassConfig	—	—
yara	Empire_Invoke_SSHCommand	—	—
yara	Empire_PowerShell_Framework_Gen1	—	—
yara	Empire_PowerUp_Gen	—	—
yara	Empire_PowerShell_Framework_Gen2	—	—
yara	Empire_Agent_Gen	—	—
yara	Empire_PowerShell_Framework_Gen3	—	—

← Prev Next →