Samir Bousseaden (YaraHunts)
- Repository
- https://github.com/sbousseaden/YaraHunts
- Commit
- 71b27a2a7c57c2aa1877a11d8933167794e2b4fb
- Retrieved
- 2026-09-27
- Licence
- No licence (all rights reserved)
- Published
- Metadata
- Why
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Rules from Samir Bousseaden (YaraHunts)
- SBOUSSEADEN_Mimikatz_KiwikeyMetadata only
hunt for default mimikatz kiwikey
Hack toolSamir Bousseaden (YaraHunts)· SBousseaden· 2020-08-08 - SBOUSSEADEN_Adsync_Creddump_V64Metadata only
Azure AdSync Service Account Password Dumping
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08 - SBOUSSEADEN_Adsync_Creddump_XorMetadata only
Azure AdSync Service Account Password Dumping
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08 - SBOUSSEADEN_Adsync_Creddump_XwideMetadata only
Azure AdSync Service Account Password Dumping
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08 - SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_StringsMetadata only
This rule is looking for some key encoded strings of the SUNBURST backdoor
APT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-12-14 - SBOUSSEADEN_APT_Xdsspy_XduploadMetadata only
No description has been set in the source file - SBousseaden
APT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-05-10 - SBOUSSEADEN_Cve_2019_1458Metadata only
No description has been set in the source file - SBousseaden
ExploitSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-22 - SBOUSSEADEN_GosliverMetadata only
No description has been set in the source file - SBousseaden
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-11 - SBOUSSEADEN_MaliciousdllgeneratorMetadata only
MaliciousDLLGenerator default decoder and export name
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-06-07 - SBOUSSEADEN_Shad0W_Beacon_16JuneMetadata only
Shad0w beacon compressed
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-06-16 - SBOUSSEADEN_Shad0W_Ldrloaddll_HookMetadata only
Shad0w beacon LdrLoadDll hook
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-06-06 - SBOUSSEADEN_TDL_Loader_Bootstrap_ShellcodeMetadata only
No description has been set in the source file - SBousseaden
MalwareSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-10 - SBOUSSEADEN_Webcreds_Regexp_B64Metadata only
No description has been set in the source file - SBousseaden
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08 - SBOUSSEADEN_Susp_Msoffice_Addins_WxllMetadata only
hunt for suspicious MS Office Addins with code injection capabilities
Suspicious / huntingSamir Bousseaden (YaraHunts)· SBousseaden· 2020-11-10 - SBOUSSEADEN_Mimikatz_Memssp_HookfnMetadata only
hunt for default mimikatz memssp module both ondisk and in memory artifacts
Hack toolSamir Bousseaden (YaraHunts)· SBousseaden· 2020-08-26 - SBOUSSEADEN_InfinityhookMetadata only
Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-09-07 - SBOUSSEADEN_Shad0W_BeaconMetadata only
Shad0w beacon default suspicous strings
GenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-06-04 - SBOUSSEADEN_Hunt_Susp_VhdMetadata only
Virtual hard disk file with embedded PE
Suspicious / huntingSamir Bousseaden (YaraHunts)· SBousseaden· 2020-07-13