YARA · SecuInfra Falcon Team

SECUINFRA_SUSP_DOTNET_PE_List_AV

Detecs .NET Binary that lists installed AVs

What this rule detects

Detecs .NET Binary that lists installed AVs

Targets: Windows PE.

It defines 2 patterns (2 text, 0 hex, 0 regex). YARA modules used: pe.

YARA-X says: warning[non_bool_expr]: non-boolean expression used as boolean

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Author: SECUINFRA Falcon Team

Source repository: SecuInfra Falcon Team @ 2d7c66d7d1

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 0f27567a-ab41-5d17-a1d8-a59c9602eb35

SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_OBFUS_Powershell_ExecutionMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02