YARA rules library

Top rules

• SIGNATURE_BASE_Mal_Lockbit4_Hashing_Alg_Win_Feb24

  This rule detects the custom hashing algorithm of Lockbit4.0 unpacked

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-16
• SIGNATURE_BASE_Mal_Lockbit4_Packed_Feb24

  Detect the packer used by Lockbit4.0

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-16
• SIGNATURE_BASE_Mal_Lockbit4_Rc4_Win_Feb24

  Detect the implementation of RC4 Algorithm by Lockbit4.0

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-13
• SIGNATURE_BASE_MAL_WIN_Akira_Apr25

  This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-11
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring

  Detects a variant of the GoLang Validalpha malware based on a file path found in the samples

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2

  Detects unknown wiper malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
• SIGNATURE_BASE_M_APT_Downloader_BEATDROP

  Rule looking for BEATDROP malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2022-04-28
• SIGNATURE_BASE_MAL_Coralwave_Lenovospkvol_Remcosmicdrop

  CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT.

  MalwareSignature Base (Florian Roth / Nextron)· xstp· 2026-01-01
• SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23

  Detects malicious VEILEDSIGNAL backdoor

  APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-20
• SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1

  Detects LockBit ransomware samples for Linux and macOS

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-04-15
• SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1

  Detects unknown wiper malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
• SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1

  Detects scheduled task pattern found in Hermetic Wiper malware related intrusions

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
• SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1

  Detects CaddyWiper malware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-03-15
• SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1

  Detects IsaacWiper malware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-03-03
• SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures

  Turla mimicking SysInternals Tools- peFeatures

  APT / threat actorSignature Base (Florian Roth / Nextron)· JAG-S· 2020-05-28
• SIGNATURE_BASE_HKTL_Meterpreter_Inmemory

  Detects Meterpreter in-memory

  Hack toolSignature Base (Florian Roth / Nextron)· netbiosX, Florian Roth· 2020-06-29
• SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2

  This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args).

  APT / threat actorSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14
• SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1

  SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA.

  APT / threat actorSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14
• SIGNATURE_BASE_MAL_Chrysalis_Backdoor_Feb26

  Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
• SIGNATURE_BASE_MAL_Chrysalis_Dllloader_Feb26

  Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
• SIGNATURE_BASE_MAL_Chrysalis_Shellcode_Loader_Feb26

  Detects shellcode used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
• SIGNATURE_BASE_MAL_Cobaltstrike_Beacon_Loader_Feb26

  Detects Cobalt Strike beacon loader

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
• SIGNATURE_BASE_MAL_Kernel_Regphantom_Mar26

  Detects RegPhantom, a kernel-mode rootkit that allow attacker to inject arbitrary code from unprivileged user-mode into kernel-mode and execute it.

  MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri (Nextron Systems)· 2026-03-19
• SIGNATURE_BASE_Mal_Babbleloader_Win_Jan24

  This rule detects intrinsic patterns of BabbleLoader.

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2025-01-27
• SIGNATURE_BASE_MAL_Katz_Stealer_May25

  Detects Katz stealer

  MalwareSignature Base (Florian Roth / Nextron)· MalGamy (Nextron Systems)· 2025-05-16
• SIGNATURE_BASE_MAL_NET_Katz_Stealer_Loader_May25

  Detects .NET based Katz stealer loader

  MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2025-05-21
• SIGNATURE_BASE_MAL_Win_Amadey_Jun25

  This rule detects intrinsic patterns of Amadey version 5.34

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2025-06-18
• SIGNATURE_BASE_MAL_WIN_Megazord_Apr25

  This Yara rule from ISH Tecnologia's Heimdall Security Research Team, detects the main components of the Megazord Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-11
• SIGNATURE_BASE_MAL_WIN_Ralordv1_Apr25

  This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-01
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT

  Detects a variant of the Atharvan 3RAT malware family

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks

  Detects a variant of the GoLang Validalpha malware

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant

  Detects a variant of the Lilith RAT malware family

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked

  Detects the Dtrack variant used by Andariel

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER

  Detects a variant of the EasyRAT malware family

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1

  Detects ICONIC stealer payload used in the 3CX incident

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
• SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2

  Detects malicious VEILEDSIGNAL backdoor

  APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29
• SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3

  Detects malicious VEILEDSIGNAL backdoor

  APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29
• SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4

  Detects malicious VEILEDSIGNAL backdoor

  APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29
• SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1

  Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23

  Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023

  MalwareSignature Base (Florian Roth / Nextron)· dr4k0nia· 2023-06-16
• SIGNATURE_BASE_MAL_DLL_Stealer_Nov23

  Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_MAL_EXE_Prestigeransomware

  Detection for Prestige Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· Silas Cutler, modfied by Florian Roth· 2023-01-04
• SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23

  Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_MAL_Shellcode_Loader_Apr23

  Detects Shellcode loader as seen being used by Gopuram backdoor

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior (Nextron Systems)· 2023-04-03
• SIGNATURE_BASE_MAL_Trojan_DLL_Nov23

  Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1

  Detects Turla Mosquito malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
• SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22

  Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated

  Hack toolSignature Base (Florian Roth / Nextron)· CodeX· 2022-07-04
• SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21

  Detects AppStorage ntstatus msexch samples

  APT / threat actorSignature Base (Florian Roth / Nextron)· CISA Code & Media Analysis· 2021-12-23
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext

  Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext

  Detects contents of the configuration file used by Exaramel (plaintext)

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Key

  Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted

  Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Socket_Path

  Detects path of the unix socket created to prevent concurrent executions in Exaramel malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings

  Detects Strings used by Exaramel malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO (composed from 4 saparate rules by Florian R…· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings_Typo

  Detects misc strings in Exaramel malware with typos

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Struct

  Detects the beginning of type _type struct for some of the most important structs in Exaramel malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Task_Names

  Detects names of the tasks received from the CC server in Exaramel malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15
• AVASTTI_Manjusaka_Payload_Elf

  No description has been set in the source file - AvastTI

  MalwareAvast / Gen Digital IOC· Gen Threat Labs· 2022-08-19
• AVASTTI_Manjusaka_Payload_Encoded_Hexstring

  No description has been set in the source file - AvastTI

  MalwareAvast / Gen Digital IOC· Gen Threat Labs· 2022-08-19
• AVASTTI_Cobaltstrike_Beacon_X64

  No description has been set in the source file - AvastTI

  Hack toolAvast / Gen Digital IOC· Gen Threat Labs· 2021-07-08