Sitemap
Pages
Guides
- What is YARA? Pattern matching for malware hunters
- YARA syntax: anatomy of a rule
- YARA strings: text, hex and regex patterns
- YARA conditions: counts, offsets, loops and sets
- YARA modules: pe, elf, dotnet, math, hash and more
- YARA performance: atoms, fast strings and conditions
- Testing YARA rules: samples, goodware and CI
- YARA-X vs YARA: differences and migration
- Writing YARA rules for incident response
- YARA rule naming and style conventions
- Public YARA rule sets, YARA Forge and licences
- YARA on VirusTotal: Livehunt and Retrohunt
- YARA cheat sheet: syntax, modifiers, conditions
Sources
- Malpedia signator rules (1582)
- Signature Base (Florian Roth / Nextron) (1078)
- SEKOIA.IO Community (706)
- ditekSHen detection (609)
- Mandiant red team tool countermeasures (147)
- Arkbird SOLG (DailyIOC) (126)
- CAPE Sandbox (CAPEv2) (121)
- RussianPanda (102)
- Volexity threat-intel (91)
- Google Cloud Threat Intelligence (GCTI) (89)
- Trellix Advanced Research Center (58)
- ESET malware-ioc (57)
- LOLDrivers (48)
- HarfangLab IOCs (38)
- Embee Research (35)
- SecuInfra Falcon Team (33)
- Avast / Gen Digital IOC (30)
- WithSecure Labs IOCs (24)
- BlackBerry Research & Intelligence (via Open-Source-YARA-rules) (21)
- Samir Bousseaden (YaraHunts) (18)
- elceef yara-rulz (16)
- Frank Boldewin (R3c0nst) (16)
- Costin Raiu yararules (10)
- Cod3nym detection-rules (8)
- Cluster25 (via Open-Source-YARA-rules) (8)
- NCSC (via Open-Source-YARA-rules) (8)
- Telekom Security malware analysis (7)
- Cado Security (via Open-Source-YARA-rules) (7)
- dr4k0nia yara-rules (4)
- Check Point (via Open-Source-YARA-rules) (4)
- Synacktiv rules (3)
- deadbits yara-rules (2)
- delivr.to detections (2)
- artifact-drop (1)
- Microsoft (via Open-Source-YARA-rules) (1)
Top families
- Cobalt Strike (130)
- Kimsuky (24)
- Lockbit (18)
- RedLine (15)
- Veiledsignal (12)
- Exaramel (11)
- Icedid (11)
- Invisimole (10)
- Amadey (9)
- Emotet (9)
- Njrat (9)
- Solarmarker (9)
- Sparrow Door (9)
- DarkSide (8)
- Koiloader (8)
- Konni (8)
- Mimikatz (8)
- Pikabot (8)
- Qakbot (8)
- Stealc (8)
- Winnti (8)
- Applejeus (7)
- BumbleBee (7)
- Common Magic (7)
- Ducktail (7)
- Hermeticwiper (7)
- Latrodectus (7)
- Lumma (7)
- Nemty (7)
- Plugx (7)
- Pwnlnx (7)
- Sidewinder (7)
- Skinnyboy (7)
- Avos Locker (6)
- Babuk (6)
- Conti (6)
- Formbook (6)
- HelloKitty (6)
- Lookback (6)
- Nighthawk (6)
- Revil (6)
- Whispergate (6)
- Windealer (6)
- Akira (5)
- Blackcat (5)
- Bluelight (5)
- Darkpink (5)
- Donot (5)
- Gopuram (5)
- Hyperbro (5)
- Manjusaka (5)
- Mars Stealer (5)
- Metastealer (5)
- Powerpool (5)
- Romcom (5)
- Vhd Ransomware (5)
- Vidar (5)
- Acidbox (4)
- Agenttesla (4)
- Aurora (4)
- Caddywiper (4)
- Chinotto (4)
- Chrysalis (4)
- Crylock (4)
- Decaf (4)
- Dotrunpex (4)
- Dtrack (4)
- Havoc (4)
- Iconic Stealer (4)
- Kazuar (4)
- Kinsing (4)
- Kwampirs (4)
- Medusalocker (4)
- Meterpreter (4)
- Mirai (4)
- Mount Locker (4)
- Nefilim (4)
- Ninerat (4)
- Parallax (4)
- Purplefox (4)
- PWSH (4)
- Qnapcrypt (4)
- Remcos (4)
- Rhadamanthys (4)
- Rokrat (4)
- Slothfulmedia (4)
- Squirrelwaffle (4)
- Stormkitty (4)
- Suncrypt (4)
- Tiger Rat (4)
- Validalpha (4)
- Vbsdownloader (4)
- WSHRAT (4)
- Xdspy (4)
- Acridrain (3)
- Action Rat (3)
- Atharvan (3)
- Aurastealer (3)
- Bazarloader (3)
- Blackmatter (3)
- Blindingcan (3)
- Coinminer (3)
- Darkbit (3)
- Darkvnc (3)
- Devilstongue (3)
- Dispcashbr (3)
- Dllloader (3)
- Dustpan (3)
- Earthworm (3)
- Egregor (3)
- Flagpro (3)
- Fonix (3)
- Gobrat (3)
- Goldenaxe (3)
- Graphite (3)
- Headertip (3)
- Hive (3)
- Iceid (3)
- Isaacwiper (3)
- Jelus Rat (3)