YARA · Microsoft (via Open-Source-YARA-rules)
MICROSOFT_Devilstongue_Hijackdll
Detects SOURGUM's DevilsTongue hijack DLL
- Author
- Microsoft Threat Intelligence Center (MSTIC)
- Date
- 2021-07-15
- Modified
- 2022-07-07
- Score / Quality
- 75 / 80
What this rule detects
Detects SOURGUM's DevilsTongue hijack DLL
Associated malware family: Devilstongue.
Targets: Windows PE.
It defines 9 patterns (7 text, 2 hex, 0 regex). YARA modules used: pe.
YARA-X says: warning[non_bool_expr]: non-boolean expression used as boolean
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Microsoft (via Open-Source-YARA-rules), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Microsoft Threat Intelligence Center (MSTIC)
Source repository: Microsoft (via Open-Source-YARA-rules) @ ec0056f767
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: b5de2a8c-e0c8-5c8c-bb65-aee5701b4bb3
Tags:FILE
Related rules
- MalwareSignature Base (Florian Roth / Nextron)· Microsoft Threat Intelligence Center (MSTIC)· 2021-07-15
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04