YARA rules for Kimsuky
24 rules from 4 sources detect Kimsuky. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: APT / threat actor, Malware.
Family grouping is heuristic: check each rule's description.
Scan files with all Kimsuky rulesSearch rules
Detects FPSpy, a backdoor used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27Detects KLogExe, a keylogger used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects a PowerShell dropper used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06Detects Kimsuky TODDLERSHARK vbs malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06Detects Kimsuky validator
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11VBS files used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detect Kimsuky LNK
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-16Detects malicious LNK used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-09-11Detects malicious VBA used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-08-30Detects compromised Chrome SecurePreferences file
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the DevTool module used by SharpExt
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the exfiltration JS code of SharpExt
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the PHP code of the SharpTongue C2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects SharpTongue variants.
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects VBS Launchers used by SharpTongue
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects VBS/Powershell Downloader used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-08-30Rule based on structure offset and file extension
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-12autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04Detects Kimsuky backdoor
MalwareditekSHen detection· ditekshen· 2020-11-06Detect the backdoors used by Kimsuky based on specific PE ressources
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-04Detect the GoBear backdoor used by Kimsuky
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-13- ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1Metadata only
Detect Gold Dragon used by Kimsuky APT group
APT / threat actorArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-31