Embee Research

Repository

https://github.com/embee-research/Yara-detection-rules

Commit

ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4

Retrieved

2026-09-27

Licence

Detection Rule License 1.1

Published

Full text

Why

YARA Forge found no LICENSE file, but the repository README states the rules are licensed under DRL 1.1 (full text included).

Download pack (.yar, 35 rules)

Rules from Embee Research

• EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· Matthew @embee_research· 2023-09-21
• EMBEERESEARCH_Win_Cobalt_Strike_Loader_Shellcode_Jun_2023

  Detection of an encoder observed with Cobalt Strike shellcode

  Hack toolEmbee Research· Matthew @ Embee_research· 2023-07-03
• EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023

  Detects default strings related to cobalt strike named pipes

  Hack toolEmbee Research· Matthew @ Embee_Research· 2023-11-04
• EMBEERESEARCH_Win_Icedid_Snowloader_Bytecodes_Oct_2023

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27
• EMBEERESEARCH_Win_Lumma_Simple_Strings
  MalwareEmbee Research· Matthew @ Embee_Research· 2023-09-13
• EMBEERESEARCH_Win_Lumma_Update_Simple_Strings_Sep_2023
  MalwareEmbee Research· Matthew @ Embee_Research· 2023-09-13
• EMBEERESEARCH_Win_Marsstealer_Encryption_Bytecodes

  Encryption observed in MarsStealer

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
• EMBEERESEARCH_Win_Medusa_Bytecodes

  Medusa Bytecodes

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27
• EMBEERESEARCH_Win_Njrat_Bytecodes_Oct_2023
  MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-03
• EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023
  MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-03
• EMBEERESEARCH_Win_Njrat_Strings_Oct_2023
  MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-03
• EMBEERESEARCH_Win_Pikabot_Loader_Bytecodes_Oct_2023

  Detects bytecodes in recent PikaBot Loaders

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-03
• EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024

  Bytecodes found in late 2023 Redline malware

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27
• EMBEERESEARCH_Win_Redline_Loader_Dec_2023

  Patterns observed in redline loader

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
• EMBEERESEARCH_Win_Redline_Payload_Dec_2023

  Patterns observed in redline

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
• EMBEERESEARCH_Win_Redline_Updated_Bytecodes_Oct_2023

  Configuration related bytecodes in redline .net files

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-11
• EMBEERESEARCH_Win_Remcos_Rat_Unpacked

  Detects strings present in remcos rat Samples.

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27
• EMBEERESEARCH_Win_Solarmarker_Bytecodes

  Detects bytecodes present in solarmarker Packer

  Suspicious / huntingEmbee Research· Matthew @ Embee_Research· 2023-09-10
• EMBEERESEARCH_Win_Solarmarker_Stage2_Bytecodes_Dec_2023

  Patterns observed in Solarmarker stage2 dll

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-28
• EMBEERESEARCH_Win_Stealc_Bytecodes_Oct_2023

  Bytecodes present in Stealc decoding routine

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27
• EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022

  Detection of string hashing routines observed in emotet

  MalwareEmbee Research· Embee_Research @ HuntressLabs· 2022-10-14
• EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022

  No description has been set in the source file - EmbeeResearch

  Hack toolEmbee Research· embee_research @ HuntressLabs· 2022-10-11
• EMBEERESEARCH_Win_Icedid_Encryption_Oct_2022

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· Embee_Research @ Huntress· 2022-10-14
• EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· @Embee_Research· 2022-11-14
• EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· Embee_Research @ Huntress· 2022-11-14
• EMBEERESEARCH_Win_Berbew_Strings_Dec_2023

  Strings observed in Berbew malware.

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
• EMBEERESEARCH_Win_Cobalt_Sleep_Encrypt

  Detects Sleep Encryption Logic Found in Cobalt Strike Deployments

  Hack toolEmbee Research· Matthew @ Embee_Research· 2023-08-27
• EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023

  Detects XLL Files Related to DarkGate

  GenericEmbee Research· Matthew @ Embee_Research· 2023-10-03
• EMBEERESEARCH_Win_Exela_Stealer_Simple_Strings_Sep_2023

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· Matthew @embee_research· 2023-09-24
• EMBEERESEARCH_Win_Orcus_Rat_Simple_Strings_Dec_2023

  Strings observed in Orcus RAT

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
• EMBEERESEARCH_Win_Xworm_Simple_Strings

  Detects simple strings present in unobfuscated xworm

  Suspicious / huntingEmbee Research· Matthew @ Embee_Research· 2023-08-30
• EMBEERESEARCH_Win_Gracewire_Loader_Dec_2022

  Yara rule to detect GraceWireLoader via usage of Stack Strings

  MalwareEmbee Research· Embee_Research @ Huntress· 2022-12-12
• EMBEERESEARCH_Win_Ursnif_Patterns_Oct_2022

  No description has been set in the source file - EmbeeResearch

  GenericEmbee Research· Embee_Research @ Huntress· 2022-10-14
• EMBEERESEARCH_Win_Mystic_Stealer_Bytecodes_Sep_2023

  No description has been set in the source file - EmbeeResearch

  MalwareEmbee Research· Matthew @ Embee_reserch· 2023-09-21
• EMBEERESEARCH_Win_Quasar_Rat_Client

  Detects strings present in Quasar Rat Samples.

  MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27