Volexity threat-intel

Repository

https://github.com/volexity/threat-intel

Commit

3a9d0b52459877ee866a9a0ba06e60059b778c77

Retrieved

2026-09-27

Licence

BSD 2-Clause License

©

Copyright 2022 by Volexity, Inc.

Published

Full text

Why

BSD 2-Clause: redistribution allowed with the copyright notice and licence text retained.

Download pack (.yar, 91 rules)

Copyright 2022 by Volexity, Inc.

The 2-Clause BSD License

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Rules from Volexity threat-intel

• VOLEXITY_Apt_Malware_Win_Deepdata_Module

  Detects modules used by DEEPDATA based on the required export names used by those modules.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30
• VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader

  Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-21
• VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes

  Detects DUSTPAN malware using API hashes used to resolve functions at runtime.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-08-17
• VOLEXITY_Apt_Win_Iconicstealer

  Detect the ICONICSTEALER malware family.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30
• VOLEXITY_Apt_Delivery_Macro_Lazypine_Jeus_B

  Detects macros used by the LazyPine threat actor to distribute AppleJeus.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• VOLEXITY_Apt_Delivery_Office_Macro_Lazypine_Jeus

  Detects malicious documents used by LazyPine in a campaign dropping the AppleJeus malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-02
• VOLEXITY_Apt_Malware_Win_Applejeus_B_Oct22

  Detects unpacked AppleJeus samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• VOLEXITY_Apt_Malware_Win_Applejeus_C_Oct22

  Detects unpacked AppleJeus samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• VOLEXITY_Apt_Malware_Win_Applejeus_D_Oct22

  Detected AppleJeus unpacked samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-10
• VOLEXITY_Apt_Malware_Win_Applejeus_Oct22

  Detects AppleJeus DLL samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• VOLEXITY_Apt_Malware_Py_Bluelight_Ldr

  Python Loader used to execute the BLUELIGHT malware family.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-22
• VOLEXITY_Apt_Malware_Rb_Rokrat_Loader

  Ruby loader seen loading the ROKRAT malware family.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-22
• VOLEXITY_Apt_Malware_Win_Bluelight

  The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-04-23
• VOLEXITY_Apt_Malware_Win_Flipflop_Ldr

  A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-05-25
• VOLEXITY_Malware_Win_Backwash_Iis_Scout

  Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2021-11-17
• VOLEXITY_Malware_Win_Cobaltstrike_D

  The CobaltStrike malware family, variant D.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2021-05-25
• VOLEXITY_Webshell_Jsp_Godzilla

  Detects the JSP implementation of the Godzilla Webshell.

  WebshellVolexity threat-intel· threatintel@volexity.com· 2021-11-08
• VOLEXITY_Apt_Malware_Any_Brickstorm_Rust

  Detects Rust variants of the BRICKSTORM malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-02-24
• VOLEXITY_Apt_Malware_Any_Uta0533_Ua

  Identify any blob containing a bogus user-agent used in different components of an attack attributed to UTA0533.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-07-06
• VOLEXITY_Apt_Malware_Js_Longtale

  Detection for LONGTALE, a chrome extension malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-09-08
• VOLEXITY_Apt_Malware_Python_Knuckleball

  Detects KNUCKLEBALL, a python based injector malware, using string patterns.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-07-06
• VOLEXITY_Apt_Malware_Win_CLEANGULP_Memoryonly

  CLEANGULP: Detects decoded runtime strings associated with command-and-control, tasking, and persistence.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-09-16
• VOLEXITY_Apt_Malware_Win_Superstomp

  Detection for the SUPERSTOMP malware used by JungleBamboo.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-09-08
• VOLEXITY_Apt_Webshell_Java_Orangetail

  Detection for ORANGETAIL, a custom Java webshell used by UTA0533.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-07-06
• VOLEXITY_Apt_Webshell_Java_Orangetail_B

  Detection for the accept logic of ORANGETAIL, a custom Java webshell used by UTA0533.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-07-06
• VOLEXITY_Apt_Malware_Any_Dotnet_Aot_Plenet

  Detect PLENET, a multiplatform malware compile with native AOT.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2025-09-22
• VOLEXITY_Apt_Malware_Elf_Verdantbamboo_Paths

  Detection for VerdantBamboo related malware based on paths from local machines observed in binaries.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2025-09-22
• VOLEXITY_Apt_Malware_Golang_Brickstorm

  Detects the BRICKSTORM backdoor using common strings.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2025-09-04
• VOLEXITY_Apt_Malware_Golang_Brickstorm_B

  Detection for the BRICKSTORM malware family.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2025-09-05
• VOLEXITY_Apt_Malware_Py_Agentpsd

  Detection for AgentPSD, a python-based malware typically delivered within PyInstaller-built binaries.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2025-09-05
• VOLEXITY_Apt_Malware_Any_Reloadext_Plugin

  Detection for RELOADEXT, a Google Chrome extension malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-23
• VOLEXITY_Apt_Malware_Linux_Disgomoji_1

  Detects GOMOJI malware using strings in the ELF.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
• VOLEXITY_Apt_Malware_Linux_Disgomoji_2

  Detects DISGOMOJI malware using strings in the ELF.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
• VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings

  Detects the DISGOMOJI malware using bogus strings introduced in the newer version.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-14
• VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String

  Detects DISGOMOJI using strings in the ELF.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
• VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader

  Detects DISGOMOJI loader using strings in the ELF.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
• VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules

  Detects DISGOMOJI modules using strings in the ELF.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-22
• VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf

  Detects a script deployed as part of DISGOMOJI malware chain.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-07
• VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum

  Detects a script deployed as part of DISGOMOJI malware chain.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-03-07
• VOLEXITY_Apt_Malware_Macos_Reloadext_Installer

  Detect the RELOADEXT installer.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-23
• VOLEXITY_Apt_Malware_Vbs_Basicstar_A

  VBS backdoor which bares architectural similarity to the POWERSTAR malware family.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-01-04
• VOLEXITY_Hacktool_Py_Pysoxy

  SOCKS5 proxy tool used to relay connections.

  Hack toolVolexity threat-intel· threatintel@volexity.com· 2024-01-09
• VOLEXITY_Malware_Golang_Discordc2_Bmdyy

  Detects a opensource malware available on github using strings in the binary. DISGOMOJI used by TransparentJasmine is based on this malware.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2024-02-22
• VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1

  Detects a opensource malware available on github using strings in the binary. The DISGOMOJI malware family used by TransparentJasmine is based on this malware.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2024-03-28
• VOLEXITY_Apt_Delivery_Web_Js_Jmask

  Detects the JMASK profiling script in its minified // obfuscated format.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-15
• VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client

  Detects a fake OpenVPN client developed by CharmingCypress.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-17
• VOLEXITY_Apt_Mac_Iconic

  Detects the MACOS version of the ICONIC loader.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30
• VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate

  Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-01
• VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23

  Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-25
• VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration

  Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-17
• VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23

  Detection for fake macOS VPN client used by CharmingCypress.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-17
• VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic

  Detects POWERSTAR modules based on common HTTP functions used across modules.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-02
• VOLEXITY_Apt_Malware_Win_Avburner

  Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-01-02
• VOLEXITY_Apt_Malware_Win_Pocostick_Jul23

  Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-24
• VOLEXITY_Apt_Webshell_Pl_Complyshell

  Detection for the COMPLYSHELL webshell.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-12-13
• VOLEXITY_Apt_Win_3Cx_Backdoored_Lib

  Detects the malicious library delivered in the backdoored 3CX installer.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30
• VOLEXITY_Apt_Win_Powerstar_Decrypt_Function

  Detects PowerStar decrypt function, potentially downloaded standalone and then injected.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16
• VOLEXITY_Apt_Win_Powerstar_Lnk

  Detects LNK command line used to install PowerStar.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16
• VOLEXITY_Apt_Win_Powerstar_Logmessage

  Detects interesting log message embedded in memory only version of PowerStar.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16
• VOLEXITY_Apt_Win_Powerstar_Persistence_Batch

  Detects the batch script used to persist PowerStar via Startup.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16
• VOLEXITY_Informational_Win_3Cx_Msi

  Detects 3CX installers created in March 2023, 3CX was known to be compromised at this time.

  GenericVolexity threat-intel· threatintel@volexity.com· 2023-03-30
• VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings

  Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-15
• VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core

  Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-02-15
• VOLEXITY_Malware_Any_Pupyrat_B

  Detects the PUPYRAT malware family, a cross-platform RAT written in Python.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2022-04-07
• VOLEXITY_Malware_Golang_Pantegana

  Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2022-03-30
• VOLEXITY_Webshell_Java_Realcmd

  Detects the RealCMD webshell, one of the payloads for BEHINDER.

  WebshellVolexity threat-intel· threatintel@volexity.com· 2022-06-01
• VOLEXITY_Webshell_Jsp_Converge

  Detects CONVERGE - a file upload webshell observed in incident involving compromise of Confluence server via CVE-2022-26134.

  WebshellVolexity threat-intel· threatintel@volexity.com· 2022-06-01
• VOLEXITY_Webshell_Jsp_Regeorg

  Detects the reGeorg webshells' JSP version.

  WebshellVolexity threat-intel· threatintel@volexity.com· 2022-03-08
• VOLEXITY_Apt_Malware_Js_Sharpext

  A malicious Chrome browser extension used by the SharpPine threat actor to steal Gmail data from a victim.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-09-14
• VOLEXITY_Apt_Malware_Ps1_Powerless_B

  Detects POWERLESS malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-10-25
• VOLEXITY_Apt_Malware_Win_Decrok

  The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-23
• VOLEXITY_Apt_Malware_Win_Freshfire

  The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-05-27
• VOLEXITY_Apt_Malware_Win_Rokload

  A shellcode loader used to decrypt and run an embedded executable.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-06-23
• VOLEXITY_Apt_Webshell_Aspx_Sportsball

  The SPORTSBALL webshell, observed in targeted Microsoft Exchange attacks in 2021. SPORTSBALL was later discovered to be a variant of HYPERSHELL, a publicly available webshell.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-03-01
• VOLEXITY_Apt_Win_Powerstar

  Custom PowerShell backdoor used by Charming Kitten.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-10-13
• VOLEXITY_Apt_Win_Powerstar_Memonly

  Detects the initial stage of the memory only variant of PowerStar.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-05-16
• VOLEXITY_Malware_Js_Xeskimmer

  Detects JScript code using in skimming credit card details.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2021-11-17
• VOLEXITY_Malware_Win_Backwash_Cpp

  CPP loader for the Backwash malware.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2021-11-17
• VOLEXITY_Malware_Win_Iis_Shellsave

  Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2021-11-17
• VOLEXITY_Webshell_Aspx_Regeorgtunnel

  A variation of the reGeorgtunnel open-source webshell.

  WebshellVolexity threat-intel· threatintel@volexity.com· 2021-03-02
• VOLEXITY_Apt_Malware_Win_Gimmick_Dotnet_Base

  Detects the base version of GIMMICK written in .NET.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2020-03-16
• VOLEXITY_Malware_Win_Backwash_Iis

  Variant of the BACKWASH malware family with IIS worm functionality.

  MalwareVolexity threat-intel· threatintel@volexity.com· 2020-09-04
• VOLEXITY_Apt_Malware_Macos_Gimmick

  Detects the macOS port of the GIMMICK malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2021-10-18
• VOLEXITY_Susp_Jsp_General_Runtime_Exec_Req

  Looks for a common design pattern in webshells where a request attribute is passed as an argument to exec().

  Suspicious / huntingVolexity threat-intel· threatintel@volexity.com· 2022-02-02
• VOLEXITY_Susp_Php_Call_User_Func

  Webshells using call_user_func() function against an object from a file input or POST variable.

  Suspicious / huntingVolexity threat-intel· threatintel@volexity.com· 2021-06-16
• VOLEXITY_Susp_Php_Fileinput_Eval

  Rule designed to detect PHP files which use file_get_contents() and then shortly afterwards use an eval statement.

  Suspicious / huntingVolexity threat-intel· threatintel@volexity.com· 2021-06-16
• VOLEXITY_Apt_Malware_Py_Upstyle

  Detect the UPSTYLE webshell.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-04-11
• VOLEXITY_Hacktool_Golang_Reversessh_Fahrj

  Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity.

  Hack toolVolexity threat-intel· threatintel@volexity.com· 2024-04-10
• VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant

  Detects the JMASK profiling script in an obfuscated format using a string array and an offset.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-06-27
• VOLEXITY_Apt_Ico_Uta0040_B64_C2

  Detection of malicious ICO files used in 3CX compromise.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-03-30
• VOLEXITY_Apt_Malware_Golang_Govershell_Strings_UTA0388

  This rule detects multiple variants of the GOVERSHELL malware family employed by UTA0388 via unique strings. The implant is side-loaded by a legitimate executable and uses various network protocol to communicate with the C2 server.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2025-06-30